SQL Injection Vulnerability in Animated Number Counters Plugin for WordPress
CVE-2026-104667
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 7 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-104667?
The Animated Number Counters WordPress plugin, prior to version 3.1, contains a serious security flaw that allows an Editor-level user to inject unsanitized values into SQL queries. This vulnerability enables unauthorized access to sensitive information, such as password hashes, through second-order SQL injection when an unauthenticated visitor accesses a page featuring the counter. It underscores the critical need for rigorous validation and sanitization of user inputs to safeguard against potential exploits.
Affected Version(s)
Animated Number Counters 0 < 3.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.