The HTTP Headers plugin for WordPress is vulnerable to External Control of File Name or Path leading to Remote Code Execution in all versions up to and including 1.19.2. This is due to insufficient validation of the file path stored in the 'hh_htpasswd_path' option and lack of sanitization on the 'hh_www_authenticate_user' option value. The plugin allows administrators to set an arbitrary file path for the htpasswd file location and does not validate that the path has a safe file extension (e.g., restricting to .htpasswd). Additionally, the username field used for HTTP Basic Authentication is written directly into the file without sanitization. The apache_auth_credentials() function constructs the file content using the unsanitized username via sprintf('%s:{SHA}%s', $user, ...), and update_auth_credentials() writes this content to the attacker-controlled path via file_put_contents(). This makes it possible for authenticated attackers, with Administrator-level access and above, to write arbitrary content (including PHP code) to arbitrary file paths on the server, effectively achieving Remote Code Execution.
The HTTP Headers WordPress plugin versions up to 1.19.2 contain a critical vulnerability allowing remote code execution through insufficient validation of file paths and unsanitized username inputs. Attackers with administrative access can write arbitrary code to attacker-controlled file paths, leading to complete system compromise.
تحتوي إضافة HTTP Headers لـ WordPress على ثغرة في التحقق من صحة مسارات الملفات وتنظيف مدخلات اسم المستخدم. يمكن للمهاجمين الذين لديهم وصول إداري كتابة ملفات PHP أو محتوى تعسفي إلى مسارات يتحكمون فيها، مما يؤدي إلى تنفيذ أوامر بعيدة.
The HTTP Headers WordPress plugin versions up to 1.19.2 contain a critical vulnerability allowing remote code execution through insufficient validation of file paths and unsanitized username inputs. Attackers with administrative access can write arbitrary code to attacker-controlled file paths, leading to complete system compromise.
Update the HTTP Headers plugin to version 1.19.3 or later immediately. Validate and restrict the 'hh_htpasswd_path' option to only allow .htpasswd file extensions. Sanitize all user input in the 'hh_www_authenticate_user' option before writing to files. Restrict administrative access to trusted users only. Review file permissions and ensure web server cannot execute files in the htpasswd directory.
قم بتحديث إضافة HTTP Headers إلى الإصدار 1.19.3 أو أحدث فوراً. تحقق من صحة مسار ملف htpasswd وقيد الامتدادات المسموحة. قم بتنظيف جميع مدخلات المستخدم قبل كتابتها في الملفات. قيد الوصول الإداري للمستخدمين الموثوقين فقط. راجع صلاحيات الملفات وتأكد من عدم قدرة خادم الويب على تنفيذ الملفات.