The plugin admin‑word‑count‑column 2.2 contains a local file read vulnerability that allows unauthenticated attackers to read arbitrary files. The flaw arises from null byte injection in the path parameter of download‑csv.php, enabling directory traversal sequences. This flaw is classified as CWE‑22 and would grant attackers read access to sensitive files such as system configurations, potentially exposing confidential information and facilitating further attacks.

The affected product is the WordPress plugin admin‑word‑count‑column, version 2.2, which is publicly available on the WordPress plugin repository. The vulnerability is limited to this specific version; updates beyond 2.2 are not mentioned in the data, so any instance of 2.2 or earlier is vulnerable.

The CVSS base score of 6.9 indicates a moderate severity. Because the attack can be performed with a simple HTTP GET request to download‑csv.php and requires no authentication, the exploitability is high for any web server hosting the vulnerable plugin. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the straightforward nature of the attack vector means that the risk remains substantial for exposed sites.