The zinoui HTTP Headers plugin for WordPress suffers from an External Control of File Name or Path vulnerability (CWE-73) due to improper validation of the 'hh_htpasswd_path' option and lack of sanitization of the 'hh_www_authenticate_user' option. The plugin allows administrator-level users to specify arbitrary file paths for the htpasswd file and directly writes unsanitized usernames into this file. The apache_auth_credentials() function formats the file content using the unsanitized username, and update_auth_credentials() writes this content to the attacker-controlled path using file_put_contents(). This chain enables authenticated administrators to write arbitrary files, including executable PHP code, resulting in remote code execution on the server. The vulnerability affects all versions up to and including 1.19.2. The CVSS v3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with administrator-level privileges can exploit this vulnerability to write arbitrary files, including PHP code, to arbitrary locations on the server. This leads to remote code execution, allowing full compromise of the affected server's confidentiality, integrity, and availability. The vulnerability poses a significant risk to affected WordPress sites using the zinoui HTTP Headers plugin up to version 1.19.2.

Patch status is not yet confirmed — no official fix or patch links are currently available. Until a vendor-provided patch or official fix is released, administrators should restrict access to the plugin settings to trusted users only and avoid using the vulnerable plugin version. Monitor the vendor's advisory channels for updates and apply official patches immediately once available.