Animated Number Counters CVE-2026-104667

Exploitation requires an attacker to already hold an Editor-level (or higher) WordPress account on the target site in order to store the malicious counter value - this is the primary limiting factor and means the flaw is only reachable on multi-author/multi-user deployments where Editors are not fully trusted. The second stage requires no authentication: the injected SQL executes automatically whenever any unauthenticated visitor renders a public page containing the affected Animated Number Counters element, so no further interaction or special configuration beyond using the plugin's counter feature is needed. Affected versions are all releases before 3.1; upgrading to 3.1 removes the condition.

This is a moderate-priority issue rather than an emergency, and the signals are largely consistent. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, base 6.8) correctly reflects a second-order flaw: the network attack vector and scope change capture that an authenticated Editor plants a payload which later executes for unauthenticated visitors, while PR:H encodes the real barrier - attacker must already hold an Editor-level account. Publicly available exploit code exists (WPScan), which raises practical risk, but this must NOT be conflated with active exploitation: the CVE is NOT in CISA KEV, so there is no evidence of in-the-wild use. No EPSS score was provided, so statistical exploitation probability cannot be weighed here - a data gap worth noting. The dominant factor limiting real-world risk is the PR:H prerequisite: on single-author or tightly-controlled sites there is no untrusted Editor, whereas on multi-author/agency/membership sites where Editors are semi-trusted, this becomes a privilege-escalation-to-data-theft path yielding password hashes. Net: credible and patch-worthy given confirmed POC and a vendor fix, but gated by the need for an existing privileged account, so prioritize on multi-author WordPress deployments.

On a multi-author WordPress site, a malicious or compromised Editor creates or edits an Animated Number Counters entry, embedding a SQL injection payload in an unsanitised counter value that is stored in the database. When any unauthenticated visitor later loads a public page rendering that counter, the payload is concatenated into a live SQL query and executed, letting the attacker exfiltrate arbitrary database contents including user password hashes. A public proof-of-concept is available via WPScan, lowering the effort required.