The HTTP Headers plugin for WordPress allows authenticated administrators to set the file path for htpasswd and provides a username field for HTTP Basic Authentication. Neither field is properly validated or sanitized. The htpasswd path can be arbitrarily set to any location on the server, and the username is written directly into the file using sprintf without escaping. Consequently, an attacker can write PHP code, or other arbitrary content, to any file path the server can access, leading to remote code execution. This flaw stems from a lack of external file path validation (CWE-73).

WordPress installations running the HTTP Headers plugin version 1.19.2 or earlier, provided by vendor zinoui. The vulnerability affects all versions up to and including 1.19.2.

The vulnerability carries a CVSS score of 7.2, indicating a high severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV. Exploitation requires the attacker to have Administrator-level access or higher in the WordPress site, but no additional privileged system access is required. Once the path and username fields are manipulated, the attacker can write and execute arbitrary code on the server, resulting in complete compromise of the affected site.