The zinoui HTTP Headers WordPress plugin versions up to 1.19.2 suffer from a CRLF Injection vulnerability (CWE-93) due to insufficient sanitization of custom header names and values before writing them into the Apache .htaccess file via the insert_with_markers() function. Authenticated attackers with Administrator privileges can inject newline characters and arbitrary Apache directives, causing configuration parse errors and potential denial of service at the web server level. The vulnerability has a CVSS 3.1 base score of 5.5, reflecting medium severity with network attack vector, low attack complexity, and high privileges required. No patch or official remediation has been published as of the data provided.

Successful exploitation can lead to injection of arbitrary Apache directives into the .htaccess file, causing configuration parse errors and potentially resulting in site-wide denial of service. There is no direct confidentiality or integrity impact reported, but availability of the affected web service can be disrupted. The attack requires authenticated Administrator-level access, limiting the threat to trusted users with elevated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator-level access to trusted users only and avoid using the 'Custom Headers' feature with untrusted input. Monitor for updates from the zinoui plugin vendor regarding patches or official mitigations.