CVE-2026-2717

OVERVIEW CVE-2026-2717 is a CRLF injection vulnerability in the HTTP Headers plugin for WordPress affecting all versions through 1.19.2. The flaw exists in insufficient input sanitization of custom header name and value fields before these values are written to the Apache .htaccess configuration file. This allows injection of arbitrary newline characters and additional Apache directives into the server configuration. SEVERITY The vulnerability requires a high-privilege threat actor with Administrator-level or higher access on the WordPress installation. Attack complexity is low and the vulnerability is network-accessible. While the impact on confidentiality is minimal, the integrity impact is moderate and the availability impact is high, potentially causing site-wide denial of service through Apache configuration parse errors. The CVSS 3.1 score of 5.5 (MEDIUM) and FAUCET Risk Score of 33.0/100 reflect this profile. EXPLOITATION STATUS The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and shows no indicators of active exploitation in the wild. The EPSS score of 0.00015 is significantly lower than the population average, suggesting minimal real-world threat activity. No public exploit code is currently available, and community attention remains limited. However, the privilege requirement makes this primarily a risk to organizations with compromised or malicious administrators rather than opportunistic threat actors.