The Burst Statistics WordPress plugin suffers from an authentication bypass vulnerability (CWE-287) due to incorrect return-value handling in the is_mainwp_authenticated() function. Specifically, when validating application passwords from the Authorization header, the function does not properly verify credentials, allowing attackers with knowledge of an administrator username to bypass authentication by providing any random Basic Authentication password. This results in unauthorized privilege escalation to administrator level for the duration of the request. The vulnerability affects versions 3.4.0 to 3.4.1.1 of the plugin. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch available at this time.

Successful exploitation allows unauthenticated attackers to impersonate an administrator user by bypassing authentication controls, leading to full privilege escalation for the duration of the request. This can compromise the confidentiality, integrity, and availability of the affected WordPress site and its analytics data. Given the critical CVSS score of 9.8, the impact is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling or removing the affected plugin versions (3.4.0 to 3.4.1.1) to prevent exploitation. Monitoring for updates from the vendor or security community is recommended.