{"id":"CVE-2023-1208","aliases":["EUVD-2023-23487","GHSA-g93m-hx8j-2qmq"],"status":"published","title":"HTTP Headers \u003c 1.18.11 - Admin+ Remote Code Execution","description":"This HTTP Headers WordPress plugin before 1.18.11 allows arbitrary data to be written to arbitrary files, leading to a Remote Code Execution vulnerability.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01716,"percentile":0.77594,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284"],"published":"2023-07-10T12:41:23Z","modified":"2026-06-17T05:27:21Z","products":[{"vendor":"riverside","product":"http_headers"},{"vendor":"unknown","product":"http headers"},{"vendor":"zinoui","product":"http headers"}],"references":[{"url":"https://wpscan.com/vulnerability/e0cc6740-866a-4a81-a93d-ff486b79b7f7","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1208"},{"url":"https://github.com/advisories/GHSA-g93m-hx8j-2qmq"}],"sources":{"cve":[{"id":"CVE-2023-1208","title":"HTTP Headers \u003c 1.18.11 - Admin+ Remote Code Execution","description":"This HTTP Headers WordPress plugin before 1.18.11 allows arbitrary data to be written to arbitrary files, leading to a Remote Code Execution vulnerability.","status":"published","published":"2023-07-10T12:41:23.248Z","modified":"2024-11-08T17:47:14.903Z","updated_at":"2026-11-02T14:35:32.019713Z"}],"euvd":[{"id":"EUVD-2023-23487","description":"This HTTP Headers WordPress plugin before 1.18.11 allows arbitrary data to be written to arbitrary files, leading to a Remote Code Execution vulnerability.","status":"published","published":"2023-07-10T12:41:23Z","modified":"2024-11-08T17:47:14Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"none"}],"updated_at":"2026-11-03T00:05:06.31936Z"}],"ghsa":[{"id":"GHSA-g93m-hx8j-2qmq","title":"This HTTP Headers WordPress plugin before 1.18.11 allows arbitrary data to be written to...","description":"This HTTP Headers WordPress plugin before 1.18.11 allows arbitrary data to be written to arbitrary files, leading to a Remote Code Execution vulnerability.","status":"published","published":"2023-07-10T18:30:47Z","modified":"2024-04-04T05:51:20Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:56:36.514369Z"}],"nvd":[{"id":"CVE-2023-1208","description":"This HTTP Headers WordPress plugin before 1.18.11 allows arbitrary data to be written to arbitrary files, leading to a Remote Code Execution vulnerability.","status":"published","published":"2023-07-10T16:15:48.833Z","modified":"2026-06-17T05:27:21.827Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:08:15.127597Z"}]}}