The zinoui HTTP Headers WordPress plugin versions up to 1.19.2 suffer from a CRLF injection vulnerability (CWE-93) due to inadequate sanitization of user-supplied custom header names and values. Authenticated users with Administrator privileges can exploit this by injecting newline characters and additional Apache directives into the .htaccess configuration file through the plugin's 'Custom Headers' settings. This manipulation can disrupt Apache's configuration parsing, resulting in site-wide denial of service. The vulnerability has a CVSS 3.1 base score of 5.5, reflecting its medium severity. No patch or official remediation level has been disclosed as of the published date.

Exploitation requires authenticated Administrator-level access to the WordPress plugin settings. Successful exploitation allows injection of arbitrary newline characters and Apache directives into the .htaccess file, causing Apache configuration errors and potentially leading to site-wide denial of service. There is no indication of confidentiality or data integrity impact beyond denial of service. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator access to trusted users only and avoid using the 'Custom Headers' feature to add untrusted input. Monitor vendor channels for updates or patches addressing this vulnerability.