HTTP Headers < 1.18.8 - Admin+ SQL Injection

Proof of Concept

1. Create an SQL file with the following contents:

UPDATE wp_options SET option_value = "Hacked" WHERE option_name = "blogname"

2. As an admin user within WP Admin, navigate to Settings > HTTP Headers > Advanced settings.
3. In the "Import" section, click on "Choose file..." and select the SQL file created above.
4. Click "Import settings".
5. Navigate to "Settings" in the sidebar and notice that the "Site Title" has been changed to "Hacked".