PT-2026-34272 · WordPress · Http Headers

Kai Aizen · Published 2026-04-22 · Updated 2026-05-01 · CVE-2026-2717

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions HTTP Headers plugin for WordPress versions prior to 1.19.3

Description Insufficient sanitization of custom header name and value fields before they are written to the Apache .htaccess file via the insert with markers() function allows authenticated attackers with Administrator-level access or higher to perform CRLF Injection. This involves injecting arbitrary newline characters and additional Apache directives into the .htaccess configuration file through the 'Custom Headers' settings, which can result in Apache configuration parse errors and a potential site-wide denial of service.

Recommendations Update the plugin to a version newer than 1.19.2. As a temporary workaround, restrict access to the 'Custom Headers' settings to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-93

Related Identifiers

CVE-2026-2717

Affected Products

Http Headers

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-2717 · Security Note
• https://reddit.com/r/StopBadBots/comments/1t0qbbs/critical_alert_20_unpatched_wordpress · Reddit Post
• https://twitter.com/CVEnew/status/2047428123113984290 · Twitter Post
• https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L1098 · Note
• https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L745 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/7716e77f-e899-4046-9421-86fc0c36c245?source=cve · Note
• https://plugins.trac.wordpress.org/browser/http-headers/tags/1.19.2/http-headers.php#L745 · Note
• https://plugins.trac.wordpress.org/browser/http-headers/trunk/http-headers.php#L1098 · Note