CVE Explorer
CVE-2026-4132
The HTTP Headers plugin for WordPress is vulnerable to External Control of File Name or Path leading to Remote Code Execution in all versions up to and including 1.19.2. This is due to insufficient validation of the file path stored in the 'hh_htpasswd_path' option and lack of sanitization on the 'hh_www_authenticate_user' option value. The plugin allows administrators to set an arbitrary file path for the htpasswd file location and does not validate that the path has a safe file extension (e.g.
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"unaffected","product":"HTTP Headers","vendor":"zinoui","versions":[{"lessThanOrEqual":"1.19.2","status":"affected","version":"0","versionType":"semver"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:37e6728ba17b617c13a71915204ad671fa40329a33908e031788840a42accfe0 · sha256:ef8482464f478893… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"baseScore":7.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:37e6728ba17b617c13a71915204ad671fa40329a33908e031788840a42accfe0 · sha256:ef8482464f478893… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-73","description":"CWE-73 External Control of File Name or Path","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:37e6728ba17b617c13a71915204ad671fa40329a33908e031788840a42accfe0 · sha256:ef8482464f478893… · /containers/cna/problemTypes/0/descriptions/0
Source references
13 source assertions{"url":"https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L1296"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:37e6728ba17b617c13a71915204ad671fa40329a33908e031788840a42accfe0 · sha256:ef8482464f478893… · /containers/cna/references/6
{"url":"https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L1298"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:37e6728ba17b617c13a71915204ad671fa40329a33908e031788840a42accfe0 · sha256:ef8482464f478893… · /containers/cna/references/4
{"url":"https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L1403"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:37e6728ba17b617c13a71915204ad671fa40329a33908e031788840a42accfe0 · sha256:ef8482464f478893… · /containers/cna/references/2
{"url":"https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L671"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:37e6728ba17b617c13a71915204ad671fa40329a33908e031788840a42accfe0 · sha256:ef8482464f478893… · /containers/cna/references/10
{"url":"https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L722"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:37e6728ba17b617c13a71915204ad671fa40329a33908e031788840a42accfe0 · sha256:ef8482464f478893… · /containers/cna/references/12
{"url":"https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L97"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:37e6728ba17b617c13a71915204ad671fa40329a33908e031788840a42accfe0 · sha256:ef8482464f478893… · /containers/cna/references/8
{"url":"https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L1296"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:37e6728ba17b617c13a71915204ad671fa40329a33908e031788840a42accfe0 · sha256:ef8482464f478893… · /containers/cna/references/5
{"url":"https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L1298"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:37e6728ba17b617c13a71915204ad671fa40329a33908e031788840a42accfe0 · sha256:ef8482464f478893… · /containers/cna/references/3
{"url":"https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L1403"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:37e6728ba17b617c13a71915204ad671fa40329a33908e031788840a42accfe0 · sha256:ef8482464f478893… · /containers/cna/references/1
{"url":"https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L671"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:37e6728ba17b617c13a71915204ad671fa40329a33908e031788840a42accfe0 · sha256:ef8482464f478893… · /containers/cna/references/9
{"url":"https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L722"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:37e6728ba17b617c13a71915204ad671fa40329a33908e031788840a42accfe0 · sha256:ef8482464f478893… · /containers/cna/references/11
{"url":"https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L97"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:37e6728ba17b617c13a71915204ad671fa40329a33908e031788840a42accfe0 · sha256:ef8482464f478893… · /containers/cna/references/7
{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ce010c6f-16bd-4178-a621-31ba6378946a?source=cve"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:37e6728ba17b617c13a71915204ad671fa40329a33908e031788840a42accfe0 · sha256:ef8482464f478893… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.