CVE-2026-104667 in Animated Number Counters Plugin
Summary
by MITRE • 10/07/2026
The Animated Number Counters WordPress plugin before 3.1 does not sanitise or escape a value stored by an Editor-level user before concatenating it into a SQL query that runs when any unauthenticated visitor renders a page containing the counter, leading to second-order SQL injection that can read arbitrary data including password hashes.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified in the Animated Number Counters WordPress plugin prior to version 3.1 represents a critical security flaw rooted in improper input validation and database query construction. This specific issue is classified as a Second-Order SQL Injection, which differs from traditional injection attacks by involving data that was previously stored within the application's database rather than being injected directly during the current request cycle. The root cause lies in the plugin's failure to properly sanitize or escape user-supplied input at the time of storage. Specifically, when an Editor-level user creates or modifies a counter configuration, the associated values are saved into the WordPress database without adequate protection against SQL metacharacters. This lack of sanitization during the write operation establishes the foundation for exploitation later in the application's lifecycle.
The operational impact manifests when any unauthenticated visitor accesses a webpage that displays one of these counters. Upon rendering the page, the plugin retrieves the previously stored counter data from the database and concatenates it directly into an SQL query without performing necessary escaping checks at this read stage. Because the malicious payload was embedded during the initial Editor-level interaction, the application treats it as legitimate data until execution time. This architectural oversight allows attackers to manipulate the structure of the SQL command executed by the backend database management system. The consequence is a severe compromise of data integrity and confidentiality, enabling remote unauthenticated actors to perform arbitrary read operations against the WordPress database.
The severity of this vulnerability is underscored by its potential to expose sensitive information such as password hashes for all users on the platform. By leveraging standard SQL injection techniques like UNION-based extraction or blind boolean inference, an attacker can query internal tables including wp_users and wp_usermeta. This capability effectively bypasses authentication mechanisms entirely since no valid credentials are required to trigger the vulnerable code path. The ability to extract password hashes facilitates offline cracking attacks, which could lead to full account compromise if weak passwords are in use. Furthermore, depending on the database configuration and privileges granted to the web application user, there may be potential for further exploitation beyond data exfiltration, although the primary risk highlighted is unauthorized data access.
From a classification perspective, this vulnerability aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command, specifically highlighting the failure to neutralize special elements during both storage and execution phases characteristic of second-order flaws. It also maps to MITRE ATT&CK techniques related to Database Query Injection and Credential Access via Unsecured Credentials or Stored Data. The attack vector is classified as Remote with Low Complexity because it requires no authentication and can be triggered by simply visiting a targeted page, making it highly exploitable in public-facing environments where such plugins are commonly deployed for aesthetic purposes on corporate or personal websites.
Mitigation strategies must address both the immediate remediation of the code flaw and broader security hygiene practices. The primary solution is to upgrade the Animated Number Counters plugin to version 3.1 or later, where this vulnerability has been patched through proper input sanitization at storage time and output escaping during query construction. Developers should adhere to the principle of least privilege by ensuring that database queries use prepared statements with parameterized inputs rather than string concatenation for all user-controlled data. Additionally, WordPress administrators should enforce strict role-based access controls and regularly audit plugins for known vulnerabilities using automated scanning tools. Implementing a Web Application Firewall can also provide an additional layer of defense by detecting and blocking common SQL injection patterns in HTTP requests, although it serves as a compensating control rather than a fix for the underlying code defect.