zinoui HTTP Headers Plugin up to 1.19.2 on WordPress apache_auth_credentials file inclusion

Summaryinfo

A vulnerability was found in zinoui HTTP Headers Plugin up to 1.19.2 on WordPress. It has been classified as problematic. The impacted element is the function apache_auth_credentials. This manipulation causes file inclusion. This vulnerability appears as CVE-2026-4132. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in zinoui HTTP Headers Plugin up to 1.19.2 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function apache_auth_credentials. The manipulation with an unknown input leads to a file inclusion vulnerability. The CWE definition for the vulnerability is CWE-73. The product allows user input to control or influence paths or file names that are used in filesystem operations. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The HTTP Headers plugin for WordPress is vulnerable to External Control of File Name or Path leading to Remote Code Execution in all versions up to and including 1.19.2. This is due to insufficient validation of the file path stored in the 'hh_htpasswd_path' option and lack of sanitization on the 'hh_www_authenticate_user' option value. The plugin allows administrators to set an arbitrary file path for the htpasswd file location and does not validate that the path has a safe file extension (e.g., restricting to .htpasswd). Additionally, the username field used for HTTP Basic Authentication is written directly into the file without sanitization. The apache_auth_credentials() function constructs the file content using the unsanitized username via sprintf('%s:{SHA}%s', $user, ...), and update_auth_credentials() writes this content to the attacker-controlled path via file_put_contents(). This makes it possible for authenticated attackers, with Administrator-level access and above, to write arbitrary content (including PHP code) to arbitrary file paths on the server, effectively achieving Remote Code Execution.

The weakness was presented by Chiao-Lin Yu. It is possible to read the advisory at wordfence.com. This vulnerability is known as CVE-2026-4132 since 03/13/2026. The exploitation appears to be easy. The attack can be launched remotely. Additional levels of successful authentication are necessary for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.19.2 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• zinoui

Name

• HTTP Headers Plugin

Version

• 1.19.0
• 1.19.1
• 1.19.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion