EUVD-2026-98348
GHSA-rmvr-f63m-c59m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as editor-level user
-
DeliverySave counter with malicious counterid value
-
ExploitTrigger read path rendering the counter
-
ExecutionUnsanitized value concatenated into unprepared query
-
ImpactExfiltrate sensitive database contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress account with editor-level capabilities or higher (PR:H), so this is not exploitable by anonymous or low-privilege users. The attacker must use the plugin's counter-save feature to store a crafted 'counterid' value, which is only exploited on the subsequent read/render path (second-order injection) - the write path itself is protected by $wpdb->prepare(). It affects Animated Number Counters versions up to and including 3.0 in default configuration; no non-default setting is needed, but the editor-or-above privilege requirement is the primary limiting factor on realistic exploitation. |
| Impact | This is a genuinely moderate, not high-priority, issue and the signals align consistently. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.9) shows a network-reachable, low-complexity SQL injection whose chief limiter is PR:H - exploitation requires editor-level access or above, meaning an already-trusted authenticated user. Impact is confined to confidentiality (C:H, database read/exfiltration) with no integrity or availability effect, matching the description's 'extract sensitive information' wording. There is no EPSS score, no CISA KEV listing, and no public POC referenced, so the exploitation status is: no public exploit identified at time of analysis. The combination of a required high-privilege insider and a confidentiality-only impact keeps real-world risk modest despite the CWE-89 label that often implies severe flaws. No conflicting signals are present, but note EPSS is absent, so probabilistic exploitation likelihood cannot be quantified - the assessment rests on the CVSS vector and Wordfence's technical description alone. |
| Exploit ScenarioDerived | An attacker who already holds editor-level (or higher) access to the WordPress admin saves a counter whose stored 'counterid' value carries an injected SQL fragment; when the plugin later reads that value back, it is concatenated unsanitized into an unprepared query, letting the attacker extract arbitrary database contents such as user records or secrets. Because this is a second-order injection, the malicious value is planted on the write path and triggered on the read path. No public exploit code is referenced, so exploitation currently requires manual crafting. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Second-order SQL injection in the Animated Number Counters WordPress plugin (all versions up to and including 3.0) allows an authenticated user with editor-level capabilities or higher to plant a crafted 'counterid' value that is later concatenated unsanitized into SQL queries, enabling extraction of sensitive data from the WordPress database. Successful exploitation requires the attacker to first store the payload through the plugin's counter-save feature and then trigger the vulnerable read/render path, so the privilege requirement (PR:H) keeps realistic risk moderate rather than critical. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited, although the vulnerability class and the appearance of an upstream code change in the plugin repository make prompt patching advisable for any site granting editor accounts to untrusted users.
RemediationAI
No vendor-released patched version has been independently confirmed at time of analysis, but an upstream fix is visible as a code change in the plugin repository trunk at https://plugins.trac.wordpress.org/changeset/3603796/animated-number-counters/trunk/settings/counters/counter-01.php, so administrators should watch the plugin's WordPress.org page for a tagged release above 3.0 and update as soon as one ships. Until a fixed version is installable, the most effective compensating control is privilege reduction: audit every account with editor or administrator capability, downgrade or remove any that do not strictly need it, and enforce least privilege and strong authentication for the remainder, since the injection cannot be reached by subscribers, contributors, or anonymous visitors (the required PR:H privilege is the primary barrier). If the plugin's animated counters are not actively used, deactivating and deleting it removes the vulnerable code entirely with no functional trade-off; if it must stay, consider a WordPress-aware WAF or virtual patching rule that inspects the counterid parameter on render requests, accepting that such rules may be bypassed by the numeric-context variant of the payload and should not be treated as a substitute for the code fix. Generic hardening such as database account least privilege and removal of unused plugins reduces blast radius but does not remediate the injection itself.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-89 SQL injection manifesting as a second-order (stored) injection in a WordPress plugin distributed by WPMart, identified by CPE cpe:2.3:a:wpmart:animated_number_counters:*:*:*:*:*:*:*:* and catalogued by Wordfence. The write path is actually safe: the plugin uses the WordPress database abstraction layer's $wpdb->prepare() when saving counter data through settings/helper/number-counter-save.php, which properly parameterizes the incoming counterid. The protection is simply not carried forward to the read path, where the previously stored value is retrieved and then concatenated directly into queries in settings/helper/functions.php (around line 312) and rendered through settings/counters/counter-01.php (lines 20 and 61). Critically, the same tainted value is interpolated in two different contexts - inside a single-quoted string literal and in a bare numeric context - meaning a payload must be shaped to break out of whichever context it reaches, and quoting fixes alone will not fully close the gap; the correct fix is to use prepared statements (or $wpdb->prepare()/cast to integer) on the read path as well. Second-order injections bypass front-end input filtering and WAF signature matching because the malicious string is stored in a legitimate-looking, previously validated record and only becomes dangerous when a different code path later trusts it, which is why this class of bug frequently survives code review in plugin ecosystems.
Know when Animated Number Counters gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Editor-level access is required so PR:H; injection is straightforward (AC:L) and network-reachable (AV:N); impact is database read only, so C:H with I:N and A:N.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Animated Number Counters plugin for WordPress is vulnerable to generic SQL Injection via the 'counterid' parameter in all versions up to, and including, 3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order SQL injection: the write path correctly uses $wpdb->prepare(), but that protection is not carried forward to the read path, where the retrieved value is concatenated unsanitized into unprepared queries in both a single-quoted string context and a bare numeric context.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Animated Number Counters
View allSecond-order SQL injection in the Animated Number Counters WordPress plugin before version 3.1 allows an attacker with a
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sk. Rated high severity
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Exploit-DB