CVE-2026-4132

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4132", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-03-13T14:17:17.140Z", "datePublished": "2026-04-22T07:45:40.959Z", "dateUpdated": "2026-04-22T18:19:04.073Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-22T07:45:40.959Z"}, "affected": [{"vendor": "zinoui", "product": "HTTP Headers", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.19.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The HTTP Headers plugin for WordPress is vulnerable to External Control of File Name or Path leading to Remote Code Execution in all versions up to and including 1.19.2. This is due to insufficient validation of the file path stored in the 'hh_htpasswd_path' option and lack of sanitization on the 'hh_www_authenticate_user' option value. The plugin allows administrators to set an arbitrary file path for the htpasswd file location and does not validate that the path has a safe file extension (e.g., restricting to .htpasswd). Additionally, the username field used for HTTP Basic Authentication is written directly into the file without sanitization. The apache_auth_credentials() function constructs the file content using the unsanitized username via sprintf('%s:{SHA}%s', $user, ...), and update_auth_credentials() writes this content to the attacker-controlled path via file_put_contents(). This makes it possible for authenticated attackers, with Administrator-level access and above, to write arbitrary content (including PHP code) to arbitrary file paths on the server, effectively achieving Remote Code Execution."}], "title": "HTTP Headers <= 1.19.2 - Authenticated (Administrator+) External Control of File Name or Path to RCE via 'hh_htpasswd_path' and 'hh_www_authenticate_user' Parameters", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ce010c6f-16bd-4178-a621-31ba6378946a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L1403"}, {"url": "https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L1403"}, {"url": "https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L1298"}, {"url": "https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L1298"}, {"url": "https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L1296"}, {"url": "https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L1296"}, {"url": "https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L97"}, {"url": "https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L97"}, {"url": "https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L671"}, {"url": "https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L671"}, {"url": "https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L722"}, {"url": "https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L722"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-73 External Control of File Name or Path", "cweId": "CWE-73", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Chiao-Lin Yu"}], "timeline": [{"time": "2026-04-21T19:13:19.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-22T18:18:43.623560Z", "id": "CVE-2026-4132", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T18:19:04.073Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4132", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-22T18:18:43.623560Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T18:18:52.827Z"}}], "cna": {"title": "HTTP Headers <= 1.19.2 - Authenticated (Administrator+) External Control of File Name or Path to RCE via 'hh_htpasswd_path' and 'hh_www_authenticate_user' Parameters", "credits": [{"lang": "en", "type": "finder", "value": "Chiao-Lin Yu"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "zinoui", "product": "HTTP Headers", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.19.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-04-21T19:13:19.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ce010c6f-16bd-4178-a621-31ba6378946a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L1403"}, {"url": "https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L1403"}, {"url": "https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L1298"}, {"url": "https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L1298"}, {"url": "https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L1296"}, {"url": "https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L1296"}, {"url": "https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L97"}, {"url": "https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L97"}, {"url": "https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L671"}, {"url": "https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L671"}, {"url": "https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L722"}, {"url": "https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L722"}], "descriptions": [{"lang": "en", "value": "The HTTP Headers plugin for WordPress is vulnerable to External Control of File Name or Path leading to Remote Code Execution in all versions up to and including 1.19.2. This is due to insufficient validation of the file path stored in the 'hh_htpasswd_path' option and lack of sanitization on the 'hh_www_authenticate_user' option value. The plugin allows administrators to set an arbitrary file path for the htpasswd file location and does not validate that the path has a safe file extension (e.g., restricting to .htpasswd). Additionally, the username field used for HTTP Basic Authentication is written directly into the file without sanitization. The apache_auth_credentials() function constructs the file content using the unsanitized username via sprintf('%s:{SHA}%s', $user, ...), and update_auth_credentials() writes this content to the attacker-controlled path via file_put_contents(). This makes it possible for authenticated attackers, with Administrator-level access and above, to write arbitrary content (including PHP code) to arbitrary file paths on the server, effectively achieving Remote Code Execution."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-73", "description": "CWE-73 External Control of File Name or Path"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-22T07:45:40.959Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4132", "state": "PUBLISHED", "dateUpdated": "2026-04-22T18:19:04.073Z", "dateReserved": "2026-03-13T14:17:17.140Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-22T07:45:40.959Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "HTTP Headers", "vendor": "zinoui", "versions": [{"lessThanOrEqual": "1.19.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The HTTP Headers plugin for WordPress is vulnerable to External Control of File Name or Path leading to Remote Code Execution in all versions up to and including 1.19.2. This is due to insufficient validation of the file path stored in the 'hh_htpasswd_path' option and lack of sanitization on the 'hh_www_authenticate_user' option value. The plugin allows administrators to set an arbitrary file path for the htpasswd file location and does not validate that the path has a safe file extension (e.g., restricting to .htpasswd). Additionally, the username field used for HTTP Basic Authentication is written directly into the file without sanitization. The apache_auth_credentials() function constructs the file content using the unsanitized username via sprintf('%s:{SHA}%s', $user, ...), and update_auth_credentials() writes this content to the attacker-controlled path via file_put_contents(). This makes it possible for authenticated attackers, with Administrator-level access and above, to write arbitrary content (including PHP code) to arbitrary file paths on the server, effectively achieving Remote Code Execution."}], "id": "CVE-2026-4132", "lastModified": "2026-06-17T10:56:02.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4132", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-22T18:18:43.623560Z", "version": "2.0.3"}}]}, "published": "2026-04-22T09:16:24.240", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L1296"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L1298"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L1403"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L671"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L722"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L97"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L1296"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L1298"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L1403"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L671"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L722"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L97"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ce010c6f-16bd-4178-a621-31ba6378946a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-73"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.19.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "HTTP Headers", "source": "cna", "vendor": "zinoui"}, "product": "http_headers", "vendor": "zinoui"}], "analysis": {"en": {"generated_at": "2026-04-22T09:23:01.566369+00:00", "value": {"mitigation_remediation": ["Upgrade the HTTP Headers plugin to the latest released version (e.g., 1.19.3 or newer) that validates the htpasswd path and sanitizes the username input.", "If an upgrade cannot be performed immediately, temporarily disable the HTTP Headers plugin or remove the capability to edit the htpasswd_path and username options in the WordPress administrator interface to block the attack vector.", "Ensure that file permissions for the WordPress wp-content directory and any directories potentially writable by the plugin are set to the minimum required for operation, preventing arbitrary file writes."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "WordPress installations running the HTTP Headers plugin version 1.19.2 or earlier, provided by vendor zinoui. The vulnerability affects all versions up to and including 1.19.2.", "description_and_impact": "The HTTP Headers plugin for WordPress allows authenticated administrators to set the file path for htpasswd and provides a username field for HTTP Basic Authentication. Neither field is properly validated or sanitized. The htpasswd path can be arbitrarily set to any location on the server, and the username is written directly into the file using sprintf without escaping. Consequently, an attacker can write PHP code, or other arbitrary content, to any file path the server can access, leading to remote code execution. This flaw stems from a lack of external file path validation (CWE-73).", "risk_and_exploitability": "The vulnerability carries a CVSS score of 7.2, indicating a high severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV. Exploitation requires the attacker to have Administrator-level access or higher in the WordPress site, but no additional privileged system access is required. Once the path and username fields are manipulated, the attacker can write and execute arbitrary code on the server, resulting in complete compromise of the affected site."}}}}, "created": "2026-04-22T09:30:13.552985+00:00", "updated": "2026-04-22T11:43:55.370220+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "zinoui", "zinoui$PRODUCT$http_headers"]}