CVE-2026-104667: Animated Number Counters WordPress SQLi

CVE-2026-104667 Overview

CVE-2026-104667 is a second-order SQL injection vulnerability in the Animated Number Counters WordPress plugin before version 3.1. The plugin fails to sanitize or escape a value stored by an Editor-level user before concatenating it into a SQL query. That query executes when any unauthenticated visitor renders a page containing the counter. Attackers who already hold Editor privileges can read arbitrary database contents, including WordPress user password hashes. The flaw is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
An authenticated Editor can plant malicious SQL that executes against the WordPress database for every anonymous page view, exfiltrating credentials and other sensitive data.

Affected Products

Animated Number Counters WordPress plugin versions before 3.1
WordPress sites with Editor-level or higher user accounts installed with the vulnerable plugin
Any public-facing WordPress page that renders the counter shortcode or block

Discovery Timeline

2026-10-07 - CVE-2026-104667 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-104667

Vulnerability Analysis

The vulnerability is a stored, or second-order, SQL injection. An Editor-level user supplies a value through the plugin's configuration interface. The plugin writes that value to the database without sanitization or parameterization. Later, when any visitor loads a page that renders the counter, the plugin reads the stored value and concatenates it directly into a SQL statement. The database executes the attacker-controlled fragment with the privileges of the WordPress database user.

Second-order injection is relevant here because the injection payload and the vulnerable sink are separated in time and request context. Standard web application firewall rules that inspect inbound requests may miss the payload because the malicious value is submitted through an authenticated administrative action that may be allowlisted.

Successful exploitation allows exfiltration of any data accessible to the WordPress database user, including the wp_users table containing password hashes. Those hashes can be cracked offline to pivot to administrator accounts.

Root Cause

The plugin concatenates stored user input into SQL rather than using prepared statements through the WordPress $wpdb->prepare() API. Input validation is absent on the storage path, and output encoding is absent on the query path. Trust is incorrectly placed in the Editor role, which the WordPress security model does not treat as fully trusted for database operations.

Attack Vector

An attacker requires an existing Editor-level account on the target WordPress site. The attacker edits a counter configuration, submits a SQL payload in the vulnerable field, and saves. The payload remains dormant in the database. Any subsequent unauthenticated visit to a page that renders the affected counter triggers the injected SQL. The attacker can retrieve results through union-based extraction, boolean inference, or time-based side channels depending on how the plugin renders the query output. See the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-104667

Indicators of Compromise

Unexpected modifications to Animated Number Counters plugin options in the wp_options or plugin-specific tables containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA
Anomalous read access against wp_users originating from front-end page rendering processes
Spikes in MySQL query latency correlated with public page views, indicating time-based inference
Editor account logins from unusual IP addresses or geographies prior to counter modifications

Detection Strategies

Audit the plugin's stored configuration values for SQL metacharacters and keywords
Enable WordPress database query logging and alert on queries containing concatenated option values with suspicious syntax
Monitor web server logs for repeated requests to pages hosting the counter shortcode, especially from a single source

Monitoring Recommendations

Track all role changes and Editor account creation events in the WordPress audit log
Baseline query patterns from front-end page renders and alert on deviations in query length or structure
Correlate authenticated administrative sessions with subsequent anonymous traffic patterns against the same URLs

How to Mitigate CVE-2026-104667

Immediate Actions Required

Update the Animated Number Counters plugin to version 3.1 or later immediately
Review all Editor and higher accounts and remove any that are unnecessary or inactive
Rotate all WordPress user passwords, assuming hashes may have been exfiltrated
Inspect the plugin's stored configuration for any payloads planted before patching

Patch Information

The vendor addressed the issue in Animated Number Counters version 3.1. Site administrators should update through the WordPress plugin dashboard or by replacing the plugin files. Confirm the installed version after update by checking the plugin metadata in wp-content/plugins/.

Workarounds

Deactivate and remove the Animated Number Counters plugin until the update is applied
Restrict the Editor role to trusted personnel only and enforce multi-factor authentication on all privileged accounts
Remove any pages or posts that render the vulnerable counter until the plugin is updated
Deploy a web application firewall rule to inspect responses for SQL error signatures as a compensating control

bash

# Verify installed plugin version and update via WP-CLI
wp plugin get animated-number-counters --field=version
wp plugin update animated-number-counters --version=3.1
wp plugin deactivate animated-number-counters  # if update not yet possible