CVE-2026-97343 burstbv CVE debrief

Who should care

WordPress administrators and users of the Burst Statistics plugin should assess exposure and prioritize verification of their installations, especially if share tokens have been shared publicly or distributed to untrusted parties.

Why it matters

The vulnerability allows unauthenticated attackers to gain permanent control of a limited-privilege account in the Burst Statistics plugin for WordPress, requiring verification and potential updates to prevent exploitation.

• Unauthenticated attackers can set an attacker-chosen password on the `burst_statistics_viewer` WordPress account.
• The attacker can gain permanent takeover of the limited-privilege (`view_burst_statistics`) account.
• The takeover persists through share-token revocation, share-token expiration, and execution of the plugin's daily `cleanup_viewer_sessions()` routine.
• Verification of plugin installations and share token management is necessary to prevent exploitation.

Technical summary

The Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Improper Authentication leading to Account Persistence in all versions up to, and including, 3.7.1. This vulnerability allows unauthenticated attackers to set an attacker-chosen password on the `burst_statistics_viewer` WordPress account, constituting a permanent takeover of that limited-privilege (`view_burst_statistics`) account that persists through share-token revocation, share-token expiration, and execution of the plugin's daily `cleanup_viewer_sessions()` routine. Exploitation requires that the attacker have obtained a valid `burst_share_token`, such as one that has been shared publicly.

Defensive priority

WordPress administrators and users of the Burst Statistics plugin should assess exposure and prioritize verification of their installations, especially if share tokens have been shared publicly or distributed to untrusted parties.

Recommended defensive actions

• Verify the installation of the Burst Statistics plugin and assess exposure to the vulnerability.
• Check for any publicly shared or distributed share tokens and revoke them if necessary.
• Update the plugin to a version that addresses the vulnerability, if available.
• Monitor for any suspicious activity related to the `burst_statistics_viewer` account.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability allows unauthenticated attackers to set an attacker-chosen password on the `burst_statistics_viewer` WordPress account, constituting a permanent takeover of that limited-privilege (`view_burst_statistics`) account that persists through share-token revocation, share-token expiration, and execution of the plugin's daily `cleanup_viewer_sessions()` routine.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.