EUVD-2026-24637
GHSA-r256-59w3-3gr2
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The HTTP Headers plugin for WordPress is vulnerable to CRLF Injection in all versions up to, and including, 1.19.2. This is due to insufficient sanitization of custom header name and value fields before writing them to the Apache .htaccess file via insert_with_markers(). This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary newline characters and additional Apache directives into the .htaccess configuration file via the 'Custom Headers' settings, leading to Apache configuration parse errors and potential site-wide denial of service.
AnalysisAI
CRLF injection in HTTP Headers WordPress plugin up to version 1.19.2 allows authenticated administrators to inject arbitrary Apache directives into .htaccess files via unsanitized custom header fields, causing configuration parse errors and potential site-wide denial of service. Attack requires Administrator-level WordPress access and no user interaction. CVSS 5.5 reflects high availability impact (A:H) balanced against high privilege requirements (PR:H).
Technical ContextAI
The vulnerability exists in the HTTP Headers plugin's handling of custom header name and value fields through the 'Custom Headers' settings interface. The plugin uses WordPress's insert_with_markers() function to write configuration to the Apache .htaccess file, but fails to sanitize user input for newline characters (CRLF - carriage return and line feed). This allows injection of arbitrary Apache directives into the configuration context. CWE-93 (Improper Neutralization of CRLF Sequences in HTTP Headers) describes the root cause: insufficient input validation before writing to a configuration file that interprets newlines as structural delimiters. Affected versions are tracked via CPE cpe:2.3:a:zinoui:http_headers:*:*:*:*:*:*:*:* covering all release and development branches up to 1.19.2.
RemediationAI
Update the HTTP Headers plugin to a patched version released after 1.19.2 when available from the plugin developer (Zinoui); check the WordPress Plugin Directory for updates. For immediate mitigation on unpatched installations, restrict WordPress Administrator role to trusted users only and audit existing Administrator accounts for signs of compromise. Additionally, configure Apache to reject .htaccess modifications by setting AllowOverride None in the virtual host configuration if the site does not require dynamic .htaccess management; this prevents the plugin from writing to .htaccess entirely but requires manual Apache configuration and may disable other .htaccess-dependent plugins. Alternatively, implement strict file permissions (chmod 444) on the .htaccess file after applying necessary configurations to prevent write access, though this requires redeployment and testing before implementing in production. Monitor Apache error logs for configuration syntax errors that may indicate exploitation attempts.
More in Http Headers
View allThis HTTP Headers WordPress plugin before 1.18.11 allows arbitrary data to be written to arbitrary files, leading to a R
This HTTP Headers WordPress plugin before 1.18.8 has an import functionality which executes arbitrary SQL on the server,
Arbitrary file write in HTTP Headers plugin for WordPress versions ≤1.19.2 enables authenticated administrators to achie
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Server-Side Request Forgery (SSRF) vulnerability in Dimitar Ivanov HTTP Headers.18.11. Rated medium severity (CVSS 4.4),
Stored cross-site scripting in HTTP Headers plugin for WordPress up to version 1.19.2 allows authenticated administrator
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today