WordPress HTTP Headers Plugin Flaw Opens Door to RCE

The National Vulnerability Database (NVD) has flagged a critical vulnerability (CVE-2026-4132) in the HTTP Headers plugin for WordPress. Versions up to and including 1.19.2 are affected. The flaw stems from insufficient validation of the htpasswd file path and unsanitized input for HTTP Basic Authentication usernames. Attackers with administrator privileges can exploit this to write arbitrary content, including malicious PHP code, to any file path on the server, leading to full remote code execution.

This vulnerability presents a significant risk to organizations running vulnerable WordPress instances. The ability for an attacker to achieve RCE by manipulating file paths and credentials means they could potentially deface websites, steal data, or use the compromised server for further malicious activities. The high CVSS score of 7.2 underscores the severity and ease with which this exploit can be leveraged by authenticated attackers.