CVE-2026-4132: 
WordPress vulnerability analysis and mitigation

CVE-2026-4132 is an External Control of File Name or Path vulnerability (CWE-73) in the HTTP Headers plugin for WordPress that enables authenticated administrators to achieve Remote Code Execution (RCE) by writing arbitrary content — including PHP code — to arbitrary server file paths. All versions up to and including 1.19.2 are affected. The vulnerability was published on April 22, 2026, with a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory, Wordfence).

The vulnerability stems from two compounding weaknesses in the plugin's HTTP Basic Authentication credential management: (1) the hh_htpasswd_path option accepts an arbitrary file path without validating that it has a safe extension (e.g., .htpasswd), and (2) the hh_www_authenticate_user option value is written to that file without sanitization. The apache_auth_credentials() function constructs file content using the unsanitized username via sprintf('%s:{SHA}%s', $user, ...), and update_auth_credentials() then writes this content to the attacker-controlled path using file_put_contents(). By supplying a PHP web shell as the username and a .php file path as the htpasswd location, an administrator-level attacker can plant executable PHP code anywhere the web server process has write access (GitHub Advisory, Wordfence).

Successful exploitation allows an authenticated attacker with WordPress Administrator-level access to execute arbitrary code with the privileges of the web server process, resulting in full confidentiality, integrity, and availability compromise of the affected server. An attacker can read sensitive data (database credentials, configuration files), modify or delete site content, and potentially pivot to other hosted applications or underlying infrastructure. The ability to write arbitrary PHP files also enables persistent backdoor installation, making remediation more complex (GitHub Advisory, Wordfence).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Wordfence). The EPSS score is approximately 0.385–0.552%, placing it in roughly the 68th percentile for exploitation likelihood within 30 days (GitHub Advisory). Exploitation requires Administrator-level WordPress credentials, which limits the attack surface but does not eliminate risk in environments with compromised or malicious admin accounts. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

1. Gain Administrator Access: Obtain WordPress administrator credentials through phishing, credential stuffing, brute force, or by leveraging a separate vulnerability that grants admin-level access.
2. Navigate to Plugin Settings: Log into the WordPress admin dashboard and navigate to the HTTP Headers plugin settings, specifically the HTTP Basic Authentication (htpasswd) configuration section.
3. Set Malicious File Path: In the hh_htpasswd_path option, enter an arbitrary writable path with a .php extension (e.g., /var/www/html/wp-content/uploads/shell.php) instead of a legitimate .htpasswd path.
4. Inject PHP Payload as Username: In the hh_www_authenticate_user field, enter a PHP web shell payload as the username (e.g., <?php system($_GET['cmd']); ?>).
5. Trigger File Write: Save the plugin settings, causing update_auth_credentials() to call file_put_contents() and write the unsanitized username (PHP code) to the attacker-specified .php file path.
6. Execute Remote Code: Access the newly created PHP file via the web server (e.g., https://target.com/wp-content/uploads/shell.php?cmd=id) to execute arbitrary OS commands with web server privileges (GitHub Advisory, Wordfence).

• File System: Unexpected .php files in writable directories such as wp-content/uploads/, wp-content/plugins/, or other web-accessible paths; files containing PHP code patterns like <?php system( or <?php eval( in non-standard locations; modification timestamps on files in web-accessible directories coinciding with admin login events.
• Logs: WordPress admin audit logs showing changes to HTTP Headers plugin settings (hh_htpasswd_path, hh_www_authenticate_user) with unusual values; web server access logs showing file_put_contents activity or requests to newly created .php files in upload directories; PHP error logs referencing apache_auth_credentials() or update_auth_credentials() with unexpected paths.
• Network: HTTP GET/POST requests to unexpected .php files in wp-content/uploads/ or similar directories, especially with query parameters like cmd, exec, or c; outbound connections from the web server process to external IPs following admin configuration changes.
• Process: Unusual child processes spawned by the PHP-FPM or Apache process (e.g., bash, curl, wget, python) after plugin settings are saved.

Update the HTTP Headers WordPress plugin to a version newer than 1.19.2 immediately, as a patch has been released (GitHub Advisory). If an immediate update is not possible, disable the HTTP Headers plugin or restrict access to the WordPress admin panel to trusted IP addresses only. Enforce the principle of least privilege by limiting the number of accounts with WordPress Administrator access. Additionally, implement server-level controls such as making web-accessible directories non-writable by the web server process, and deploy a Web Application Firewall (WAF) to monitor for suspicious file write operations (Wordfence).

Wordfence, which discovered and reported the vulnerability, included it in their weekly WordPress vulnerability report for the week of April 20–26, 2026 (Wordfence Blog). Red Hat also published a CVE entry for this vulnerability, indicating broader ecosystem awareness (Red Hat). No significant social media discussion or notable independent researcher commentary has been identified beyond standard CVE aggregator coverage.