Unauthenticated administrator impersonation via null authentication result

Authentication bypass in Burst Statistics 3.4.0 through 3.4.1.1 allows remote attackers to impersonate administrators via HTTP. The is_mainwp_authenticated() method treats any non-WP_Error result from wp_authenticate_application_password() as success, so a null result permits wp_set_current_user() to select the supplied username. Exploitation requires a valid administrator username and delivery of the Authorization header to PHP; the resulting request can create a new administrator account.