What is the CVSS score of EUVD-2026-24674?

EUVD-2026-24674 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of HTTP Headers are affected by EUVD-2026-24674?

CVE-2026-4132 affects HTTP Headers plugin for WordPress up to version 1.19.2 and allows authenticated site administrators to write arbitrary files and execute remote code on the server by exploiting…

How to fix or mitigate EUVD-2026-24674?

Within 24 hours: Identify all WordPress installations running HTTP Headers plugin ≤1.19.2 and immediately revoke unnecessary administrator accounts; disable the plugin if not critical to operations. Within 7 days: Monitor Wordfence and vendor advisories for patch release to version 1.19.3 or later; prepare upgrade testing environment. Within 30 days: Apply vendor patch to HTTP Headers plugin across all affected WordPress instances and conduct access review to ensure only essential administrators retain credentials.

HTTP Headers EUVD-2026-24674

| CVE-2026-4132 HIGH

External Control of File Name or Path (CWE-73)

2026-04-22 Wordfence

PHP WordPress RCE

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 20:37 vuln.today

cvss_changed

Analysis Generated

Apr 22, 2026 - 09:59 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 08:30 euvd

EUVD-2026-24674

Analysis Generated

Apr 22, 2026 - 08:30 vuln.today

CVE Published

Apr 22, 2026 - 07:45 nvd

HIGH 7.2

DescriptionCVE.org

The HTTP Headers plugin for WordPress is vulnerable to External Control of File Name or Path leading to Remote Code Execution in all versions up to and including 1.19.2. This is due to insufficient validation of the file path stored in the 'hh_htpasswd_path' option and lack of sanitization on the 'hh_www_authenticate_user' option value. The plugin allows administrators to set an arbitrary file path for the htpasswd file location and does not validate that the path has a safe file extension (e.g., restricting to .htpasswd). Additionally, the username field used for HTTP Basic Authentication is written directly into the file without sanitization. The apache_auth_credentials() function constructs the file content using the unsanitized username via sprintf('%s:{SHA}%s', $user, ...), and update_auth_credentials() writes this content to the attacker-controlled path via file_put_contents(). This makes it possible for authenticated attackers, with Administrator-level access and above, to write arbitrary content (including PHP code) to arbitrary file paths on the server, effectively achieving Remote Code Execution.

AnalysisAI

Arbitrary file write in HTTP Headers plugin for WordPress versions ≤1.19.2 enables authenticated administrators to achieve remote code execution by manipulating htpasswd file path configuration and injecting PHP code via unsanitized username input. Administrators can set a malicious file path (e.g., webroot/shell.php) through 'hh_htpasswd_path' option and inject executable code via the 'hh_www_authenticate_user' field, which is written directly to disk without validation. Wordfence disclosure includes direct source code references showing the vulnerable apache_auth_credentials() and update_auth_credentials() functions. No public exploit code or active exploitation confirmed at time of analysis.

Technical ContextAI

This vulnerability affects the HTTP Headers WordPress plugin (cpe:2.3:a:zinoui:http_headers) and stems from CWE-73 (External Control of File Name or Path). The plugin implements HTTP Basic Authentication functionality that writes htpasswd-style credentials to disk. The apache_auth_credentials() function constructs file content using sprintf('%s:{SHA}%s', $user, ...) without sanitizing the $user variable, while update_auth_credentials() uses file_put_contents() to write to a path controlled by the 'hh_htpasswd_path' option. PHP's file_put_contents() will create files with any extension when given an absolute path, and the plugin fails to restrict paths to safe locations or validate file extensions. By combining path traversal control with content injection through the username parameter, attackers can write arbitrary PHP code to web-accessible locations, bypassing WordPress's normal file upload restrictions.

RemediationAI

Immediately upgrade the HTTP Headers plugin to a version newer than 1.19.2 if available, verifying the vendor has addressed path traversal and input sanitization issues in apache_auth_credentials() and update_auth_credentials() functions per Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ce010c6f-16bd-4178-a621-31ba6378946a. Check the WordPress plugin repository for updated releases. If no patched version exists, implement compensating controls: (1) disable or uninstall the HTTP Headers plugin if HTTP Basic Authentication functionality is not required for business operations, (2) restrict WordPress administrator access to only highly trusted users and enforce multi-factor authentication on all admin accounts to reduce credential compromise risk, (3) implement filesystem-level permissions preventing the web server user from writing to web-accessible directories outside wp-content/uploads, noting this may break legitimate plugin functionality, (4) deploy web application firewall rules to monitor and alert on suspicious file creation in webroot directories, and (5) conduct forensic review of existing files in webroot for unexpected PHP files that may indicate prior exploitation, particularly files with htpasswd-style content or recently modified timestamps coinciding with administrator logins.