Vulnerability · Published Apr 25, 2022 · Assigned by WPScan
CVE-2022-1390Admin Word Count Column <= 2.2 - Unauthenticated Arbitrary File Read
Critical 9.8
In plain English
A critical-severity path traversal in Admin Word Count Column from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 21.9% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)21.9%top 2.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile(), which could allow unauthenticated attackers to read arbitrary files on server running old version of PHP susceptible to the null byte technique. This could also lead to RCE by using a Phar Deserialization technique
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Admin Word Count Column | 2.2 – through 2.2 |
Weakness: CWE-22
References
- https://wpscan.com/vulnerability/6293b319-dc4f-4412-9d56-55744246c990 x_refsource_MISC
- https://packetstormsecurity.com/files/166476/ x_refsource_MISC