What is the CVSS score of CVE-2026-2717?

CVE-2026-2717 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.0%.

HTTP Headers WordPress Plugin CVE-2026-2717

EUVD-2026-24637 MEDIUM

Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)

2026-04-22 Wordfence

GHSA-r256-59w3-3gr2

Apache Denial Of Service WordPress

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 10:02 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 08:30 euvd

EUVD-2026-24637

Analysis Generated

Apr 22, 2026 - 08:30 vuln.today

CVE Published

Apr 22, 2026 - 07:45 nvd

MEDIUM 5.5

DescriptionCVE.org

The HTTP Headers plugin for WordPress is vulnerable to CRLF Injection in all versions up to, and including, 1.19.2. This is due to insufficient sanitization of custom header name and value fields before writing them to the Apache .htaccess file via insert_with_markers(). This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary newline characters and additional Apache directives into the .htaccess configuration file via the 'Custom Headers' settings, leading to Apache configuration parse errors and potential site-wide denial of service.

AnalysisAI

CRLF injection in HTTP Headers WordPress plugin up to version 1.19.2 allows authenticated administrators to inject arbitrary Apache directives into .htaccess files via unsanitized custom header fields, causing configuration parse errors and potential site-wide denial of service. Attack requires Administrator-level WordPress access and no user interaction. CVSS 5.5 reflects high availability impact (A:H) balanced against high privilege requirements (PR:H).

Technical ContextAI

The vulnerability exists in the HTTP Headers plugin's handling of custom header name and value fields through the 'Custom Headers' settings interface. The plugin uses WordPress's insert_with_markers() function to write configuration to the Apache .htaccess file, but fails to sanitize user input for newline characters (CRLF - carriage return and line feed). This allows injection of arbitrary Apache directives into the configuration context. CWE-93 (Improper Neutralization of CRLF Sequences in HTTP Headers) describes the root cause: insufficient input validation before writing to a configuration file that interprets newlines as structural delimiters. Affected versions are tracked via CPE cpe:2.3:a:zinoui:http_headers:*:*:*:*:*:*:*:* covering all release and development branches up to 1.19.2.

RemediationAI

Update the HTTP Headers plugin to a patched version released after 1.19.2 when available from the plugin developer (Zinoui); check the WordPress Plugin Directory for updates. For immediate mitigation on unpatched installations, restrict WordPress Administrator role to trusted users only and audit existing Administrator accounts for signs of compromise. Additionally, configure Apache to reject .htaccess modifications by setting AllowOverride None in the virtual host configuration if the site does not require dynamic .htaccess management; this prevents the plugin from writing to .htaccess entirely but requires manual Apache configuration and may disable other .htaccess-dependent plugins. Alternatively, implement strict file permissions (chmod 444) on the .htaccess file after applying necessary configurations to prevent write access, though this requires redeployment and testing before implementing in production. Monitor Apache error logs for configuration syntax errors that may indicate exploitation attempts.