CVE-2022-1390

Name of the Vulnerable Software and Affected Versions Admin Word Count Column WordPress plugin versions 2.2 and earlier

Description The issue allows unauthenticated attackers to read arbitrary files on a server running an old version of PHP susceptible to the null byte technique. This could also lead to remote code execution (RCE) by using a Phar Deserialization technique.

Recommendations For Admin Word Count Column WordPress plugin versions 2.2 and earlier, update to a version that fixes the issue with the readfile() function and its handling of the path parameter to prevent arbitrary file reading and potential RCE.