Animated Number Counters <= 2.9 - Authenticated (Editor+) SQL Injection via 'rearrange_counter_list' Parameter
- ID
- WPSEC-2026-0393
- Plugin
- Animated Number Counters (animated-number-counters)
- Affected
- all versions before 3.1
- Remediation
- Update to 3.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-89
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Animated Number Counters on WPSec AttackSurface
- Fix released
- Published
Description
The Animated Number Counters plugin for WordPress is vulnerable to second-order SQL Injection via the 'rearrange_counter_list' parameter in all versions up to, and including, 2.9. This is due to the counter IDs submitted through the plugin's counter rearrange form being stored with only text sanitization and later interpolated, unquoted, into an SQL query without casting or preparation when the plugin's shortcode is rendered. Because the plugin grants users with the Editor role access to its settings pages, this makes it possible for authenticated attackers, with editor-level access and above, to append additional SQL queries to existing queries and extract sensitive information from the database.
References
- https://wpsec.com/vuln/WPSEC-2026-0393/
- https://plugins.svn.wordpress.org/animated-number-counters/tags/3.1/
- https://wordpress.org/plugins/animated-number-counters/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS