HTTP Headers vulnerabilities

1 known vulnerability in HTTP Headers from Zinoui. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  HTTP Headers: External Control of File Name or Path

  CVE-2026-4132Apr 22, 2026Zinoui

  The HTTP Headers plugin for WordPress is vulnerable to External Control of File Name or Path leading to Remote Code Execution in all versions up to and including 1.19.2. This is due to insufficient validation of the file path stored in the 'hh_htpasswd_path' o