The HTTP Headers plugin for WordPress (zinoui) suffers from an External Control of File Name or Path vulnerability (CWE-73) in versions up to 1.19.2. The plugin allows administrators to specify an arbitrary file path for the htpasswd file without validating the file extension or sanitizing the username used in HTTP Basic Authentication. The apache_auth_credentials() function uses the unsanitized username to generate file content, which update_auth_credentials() writes to the attacker-controlled path. This flaw enables authenticated users with Administrator privileges to write arbitrary files, including executable PHP code, resulting in remote code execution on the server.

An attacker with Administrator-level access can exploit this vulnerability to write arbitrary files to any location on the server. This can lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system. The CVSS 3.1 base score is 7.2, reflecting high impact on confidentiality, integrity, and availability with network attack vector and low attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator access to trusted users only and monitor for suspicious activity related to file writes. Avoid using the vulnerable plugin version if possible.