CVE-2026-2717
CRLF Injection in WordPress HTTP Headers Plugin Causes DoS
Publication date: 2026-04-22
Last updated on: 2026-04-22
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordfence | http_headers_plugin | to 1.19.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-93 | The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an authenticated attacker with Administrator-level access to inject malicious directives into your Apache .htaccess file.
Such injection can cause Apache configuration parse errors, which may result in a site-wide denial of service, making your website unavailable to users.
Can you explain this vulnerability to me?
The HTTP Headers plugin for WordPress has a vulnerability known as CRLF Injection in all versions up to and including 1.19.2. This occurs because the plugin does not properly sanitize custom header names and values before writing them to the Apache .htaccess file using the insert_with_markers() function.
An attacker with Administrator-level access or higher can exploit this by injecting arbitrary newline characters and additional Apache directives into the .htaccess configuration file through the 'Custom Headers' settings.
This injection can cause Apache configuration parse errors and potentially lead to a site-wide denial of service.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves injection of arbitrary newline characters and Apache directives into the .htaccess file via the 'Custom Headers' settings in the HTTP Headers WordPress plugin.
To detect this vulnerability on your system, you should check the .htaccess file for unexpected or suspicious Apache directives or newline characters that were not intentionally added.
Since the vulnerability requires Administrator-level access to exploit, reviewing recent changes to the .htaccess file and auditing the 'Custom Headers' settings in the WordPress HTTP Headers plugin is recommended.
- Use command-line tools to inspect the .htaccess file, for example: `cat /path/to/.htaccess` or `less /path/to/.htaccess`.
- Search for suspicious or unexpected Apache directives or newline characters using: `grep -P '\n' /path/to/.htaccess` or `grep -E 'RewriteRule|Redirect|<IfModule>' /path/to/.htaccess`.
- Audit WordPress plugin settings via the admin interface to review any custom headers configured.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include removing or updating the vulnerable HTTP Headers plugin to a version later than 1.19.2 where the issue is fixed.
Restrict Administrator-level access to trusted users only, as exploitation requires such privileges.
Review and sanitize any custom header name and value fields configured in the plugin to ensure they do not contain newline characters or malicious Apache directives.
Manually inspect and clean the .htaccess file to remove any injected malicious directives or malformed entries.
Consider temporarily disabling the HTTP Headers plugin until a patched version is applied.