CVE-2026-4132

High

Published: 22 April 2026

Published

22 April 2026

Modified

22 April 2026

KEV Added

—

Patch

—

CVSS Score 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0039 59.8th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-4132 is a high-severity External Control of File Name or Path (CWE-73) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 40.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly addresses the insufficient validation of the 'hh_htpasswd_path' file path and lack of sanitization on the 'hh_www_authenticate_user' option, preventing arbitrary file writes and RCE.

SI-2 Flaw Remediation good match

prevent

Requires timely remediation of the specific flaw in the HTTP Headers plugin versions up to 1.19.2, eliminating the vulnerability through patching.

SI-7 Software, Firmware, and Information Integrity good match

detect

Monitors software and file integrity to detect unauthorized modifications from attacker-controlled file writes via file_put_contents(), identifying RCE attempts.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

Vulnerability enables arbitrary file write of PHP code in public-facing WordPress plugin, directly facilitating exploitation of the application for RCE (T1190) and web shell deployment (T1505.003).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

The HTTP Headers plugin for WordPress is vulnerable to External Control of File Name or Path leading to Remote Code Execution in all versions up to and including 1.19.2. This is due to insufficient validation of the file path stored…

in the 'hh_htpasswd_path' option and lack of sanitization on the 'hh_www_authenticate_user' option value. The plugin allows administrators to set an arbitrary file path for the htpasswd file location and does not validate that the path has a safe file extension (e.g., restricting to .htpasswd). Additionally, the username field used for HTTP Basic Authentication is written directly into the file without sanitization. The apache_auth_credentials() function constructs the file content using the unsanitized username via sprintf('%s:{SHA}%s', $user, ...), and update_auth_credentials() writes this content to the attacker-controlled path via file_put_contents(). This makes it possible for authenticated attackers, with Administrator-level access and above, to write arbitrary content (including PHP code) to arbitrary file paths on the server, effectively achieving Remote Code Execution.

Deeper analysisAI

CVE-2026-4132 is an External Control of File Name or Path vulnerability (CWE-73) in the HTTP Headers plugin for WordPress, affecting all versions up to and including 1.19.2. The issue arises from insufficient validation of the 'hh_htpasswd_path' option, which allows administrators to specify an arbitrary file path for the htpasswd file without restricting it to safe extensions like .htpasswd. Additionally, the 'hh_www_authenticate_user' option lacks sanitization, enabling malicious input. The apache_auth_credentials() function constructs file content using the unsanitized username via sprintf('%s:{SHA}%s', $user, ...), and the update_auth_credentials() function writes this content to the attacker-controlled path using file_put_contents(), facilitating remote code execution.

Authenticated attackers with Administrator-level access or higher can exploit this vulnerability by configuring the plugin's settings with a malicious file path and username containing arbitrary content, such as PHP code. This allows them to write files to arbitrary locations on the server, achieving remote code execution. The CVSS v3.1 base score is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting network accessibility, low attack complexity, high required privileges, and high impacts on confidentiality, integrity, and availability.

References for CVE-2026-4132 point to specific lines in the vulnerable http-headers.php file from plugin version 1.19.2: line 1296 and 1298 (likely related to path handling), line 1403 (content construction), and lines 671 and 722 (file writing operations). No patch or mitigation details are provided in the available information.