Burst Statistics Vulnerability: Attackers Are Already Inside Sites Like Yours
Someone could be logged into your WordPress site right now — and you wouldn't know.
That's not scaremongering. As of 3 June 2026, attackers are actively exploiting a critical security flaw in the Burst Statistics plugin, which is installed on over 200,000 WordPress sites worldwide. If you're running it, this needs your attention today.
What's Actually Happening With the Burst Statistics Plugin
On 13 May 2026, Wordfence publicly disclosed a critical vulnerability in Burst Statistics — a popular WordPress analytics plugin. The flaw is classified as an Authentication Bypass, which in plain English means: an attacker who knows your admin username can log in as you, without needing your password.
No brute force. No guessing games. Just your username — which for many sites is still "admin" or visible in post author fields — and they're in.
According to Wordfence's disclosure, the vulnerability affects unauthenticated attackers, meaning anyone on the internet can attempt this. No account required. No prior access needed.
That's about as bad as it gets.
Who Is Actually at Risk Here
If Burst Statistics is installed and active on your site — or a client's site — you're in the affected group. With 200,000 active installations, the chances that someone in your agency's client list is running it are high.
Do you know offhand which analytics plugin is running on every site you manage? Most people don't, and that's exactly the gap attackers count on.
The risk is especially real if:
- Your admin username is "admin" or matches your public-facing name
- You haven't updated the plugin since mid-May 2026
- You're running a site with user registration enabled, or any kind of member area
Once an attacker is logged in as an administrator, they can install other plugins, create backdoors, redirect your traffic, steal customer data, or quietly sit there for months without triggering anything obvious.
What You Should Do Right Now
Step one: check if you're running Burst Statistics. Log into your WordPress dashboard, go to Plugins, and search for it. If it's there, note the version number.
Step two: update it immediately. The patched version was released around the time of Wordfence's 13 May 2026 disclosure. Go to Plugins → Updates and apply it now. Don't wait for your next maintenance window.
Step three: check your admin username. If your main admin account is literally called "admin", change it. This vulnerability requires an attacker to know a valid admin username — so using something non-obvious cuts their attack surface significantly.
Step four: check your user list for anything suspicious. Go to Users in your WordPress dashboard and look for accounts you don't recognise, especially any with Administrator role. If something's there that shouldn't be, your site may already be compromised.
Not sure how to handle a potentially compromised site? Wordfence offers a free plugin with a site scanner that can flag known malware and modified files. That's a reasonable starting point.
Can Uptrue Detect This Kind of Problem?
Not the hack itself — no uptime monitor can read your user database. But here's what does happen when a site gets compromised through a flaw like this: things start breaking. Pages slow down. The site goes offline while attackers install their tools. SSL certificates get tampered with. Redirect chains appear that point your visitors somewhere else entirely.
Uptrue monitors WordPress sites continuously for exactly those symptoms — downtime, slow response times, SSL issues, and unexpected behaviour. Right now, Uptrue is tracking 439 sites, with 91 currently showing degraded performance. If your site starts acting strangely after an intrusion, you'll know within minutes rather than when a client rings at 9am.
You can check your site's uptime score or set up monitoring in under two minutes. It won't stop an attacker getting in through a plugin flaw. But it will tell you when something's gone wrong, fast.
Frequently Asked Questions
What is the Burst Statistics vulnerability? It's an Authentication Bypass flaw in the Burst Statistics WordPress plugin, disclosed on 13 May 2026, that allows an attacker who knows an admin username to log into your site without a password.
How many WordPress sites are affected by the Burst Statistics flaw? Burst Statistics has over 200,000 active installations, all of which were potentially at risk before the patch was released.
How do I fix the Burst Statistics vulnerability? Update the Burst Statistics plugin to the latest version via your WordPress dashboard under Plugins → Updates. Do it today.
How do I know if my site has already been hacked? Check your Users list in WordPress for unrecognised administrator accounts. Also look for any plugins or files you don't recognise. A tool like Wordfence's free scanner can help flag suspicious changes.
Does changing my admin username help? Yes. This specific vulnerability requires the attacker to know a valid admin username. Using a non-obvious username makes the attack harder to execute, though updating the plugin is still essential.