Authenticated administrators can exploit the HTTP Headers WordPress plugin by inserting CRLF characters into custom header names or values, causing malicious newline insertion into the site’s .htaccess file. This injection is permitted because the plugin fails to sanitize user input before writing to .htaccess through insert_with_markers. The injected directives can break the Apache configuration and lead to site-wide service disruption, consistent with CWE‑93.

Vendors and products affected are the Zinoui HTTP Headers WordPress plugin. All releases up to and including version 1.19.2 are vulnerable. No specific build or platform details are listed beyond the WordPress environment.

The vulnerability carries a CVSS score of 5.5, indicating a moderate severity. No EPSS score is available and the issue is not listed in the CISA KEV catalog. The attack requires authenticated Administrator‑level access to the WordPress dashboard, after which an attacker can craft malicious header values and trigger the injection. If exploited, the effect is a denial of service resulting from corrupt .htaccess parsing.