allowed_http_origins() only works in theme functions.php

// Ref https://wordpress.stackexchange.com/questions/342767/allowed-http-origins-only-works-in-theme-functions-php
add_action( 'send_headers', 'add_cors_http_header' );

function add_cors_http_header()
{
    header("Access-Control-Allow-Origin: *");
}