CVE-2022-1390: The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile(), which could allow unauthenticated attackers to read arbitrary files on server runn...

Summary

The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile(), which could allow unauthenticated attackers to read arbitrary files on server running old version of PHP susceptible to the null byte technique. This could also lead to RCE by using a P...

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
admin_word_count_column_project	admin_word_count_column	<= 2.2 `cpe:2.3:a:admin_word_count_column_project:admin_word_count_column::::::wordpress::*`

Original advisory text

The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile(), which could allow unauthenticated attackers to read arbitrary files on server runn...

The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile(), which could allow unauthenticated attackers to read arbitrary files on server running old version of PHP susceptible to the null byte technique. This could also lead to RCE by using a Phar Deserialization technique

References

https://packetstormsecurity.com/files/166476/ Exploit Third Party Advisory VDB Entry
https://wpscan.com/vulnerability/6293b319-dc4f-4412-9d56-55744246c990 Exploit Third Party Advisory