Burst Statistics WordPress Plugin Authentication Bypass Vulnerability Allowing Admin Impersonation

A vulnerability allowing authentication bypass has been identified in the Burst Statistics WordPress plugin, specifically in versions 3.4.0 to 3.4.1.1. The issue arises from improper handling of return values in the 'is_mainwp_authenticated()' function, which validates application passwords from the Authorization header. This flaw enables unauthenticated attackers who know an administrator's username to impersonate that administrator for the duration of the request by using any random Basic Authentication password, thereby escalating privileges.

Impact

Exploitation of this vulnerability allows for unauthorized users to gain administrative privileges on the affected WordPress site, potentially leading to further malicious actions such as modifying site content, managing users, or installing harmful plugins.

Reproduction

To reproduce this vulnerability, send a request to the WordPress site with the 'Authorization' header set to 'Basic' followed by a base64-encoded string of 'admin_username:random_password'. Replace 'admin_username' with the username of an existing administrator. The request must be directed to the 'burst/v1/mainwp-auth' endpoint.

Remediation

Users are advised to update the Burst Statistics WordPress plugin to version 3.4.2 or later.