CVE-2022-1390
📋 TL;DR
The Admin Word Count Column WordPress plugin through version 2.2 contains a path traversal vulnerability in the readfile() function that allows unauthenticated attackers to read arbitrary files on servers running old PHP versions susceptible to null byte injection. This can lead to Remote Code Execution via Phar deserialization. All WordPress sites using vulnerable plugin versions are affected.
💻 Affected Systems
- Admin Word Count Column WordPress Plugin
📦 What is this software?
Admin Word Count Column by Admin Word Count Column Project
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise via RCE leading to data theft, malware deployment, and complete system control
Likely Case
Arbitrary file disclosure including configuration files, database credentials, and sensitive data
If Mitigated
Limited impact with proper file permissions and modern PHP versions
🎯 Exploit Status
Exploit code is publicly available and trivial to execute
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.2.1
Vendor Advisory: https://wpscan.com/vulnerability/6293b319-dc4f-4412-9d56-55744246c990
Restart Required: No
Instructions:
1. Update Admin Word Count Column plugin to version 2.2.1 or later via WordPress admin panel. 2. Verify update completed successfully. 3. Test plugin functionality.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily disable the Admin Word Count Column plugin until patched
wp plugin deactivate admin-word-count-column
Update PHP version
linuxUpgrade to PHP 7.0+ to mitigate null byte injection vulnerability
sudo apt update && sudo apt install php7.4
🧯 If You Can't Patch
- Remove plugin entirely from WordPress installation
- Implement web application firewall rules to block path traversal attempts
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel for Admin Word Count Column plugin version. If version is 2.2 or earlier, system is vulnerable.Check Version:
wp plugin get admin-word-count-column --field=versionVerify Fix Applied:
Verify plugin version is 2.2.1 or later in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in web server logs
- Requests containing path traversal sequences like ../ or null bytes
Network Indicators:
- HTTP requests to plugin endpoints with file path parameters
SIEM Query:
source="web_access.log" AND (uri="*admin-word-count-column*" AND (uri="*../*" OR uri="*%00*"))