CVE

CVE-2022-1390

9.8

CVSS

Description

The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile(), which could allow unauthenticated attackers to read arbitrary files on server running old version of PHP susceptible to the null byte technique. This could also lead to RCE by using a Phar Deserialization technique

Attack Vector

Privileges Req.

User Interaction

admin word count column

Updated Sep 18, 2026View on NVD →

S4E scanner

criticalProduct Based Web Vulnerabilities~10 seconds

CVE-2022-1390 Scanner

CVE-2022-1390 scanner - Path Traversal vulnerability in Admin Word Count Column plugin for WordPress

Used 2.1k times · 5.9k assets checked · url

Scanner page →Run scanner

CVE history: admin word count column

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →