Remote Code Execution Vulnerability in HTTP Headers Plugin for WordPress

CVE-2026-4132

What is CVE-2026-4132?

The HTTP Headers plugin for WordPress presents a significant security risk through its inadequate validation of file paths. This flaw permits authenticated users with Administrator-level access to manipulate the 'hh_htpasswd_path' option, leading to the execution of arbitrary PHP code on the server. The vulnerability stems from the lack of sanitization when writing username data for HTTP Basic Authentication into the specified file. As a result, attackers can exploit this weakness to gain complete control over the server, utilizing remote code execution techniques.

References