SQL Injection Vulnerability in Animated Number Counters Plugin for WordPress
CVE-2026-15399

4.9MEDIUM

Key Information:

Vendor

WordPress
Status
Animated Number Counters
Vendor
CVE Published:
13 October 2026

What is CVE-2026-15399?

The Animated Number Counters plugin for WordPress is subject to a SQL Injection vulnerability due to inadequate escaping of user-supplied parameters, specifically the 'counterid' parameter. This issue exists in all plugin versions up to and including 3.0. Authenticated attackers with editor privileges can exploit this flaw to inject malicious SQL queries into the existing queries. While the write operations correctly utilize $wpdb->prepare(), the read operations concatenate unsanitized values into queries, allowing the potential extraction of sensitive database information.

Affected Version(s)

Animated Number Counters 0 <= 3.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/animated-numbe...
https://plugins.trac.wordpress.org/browser/animated-numbe...

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wordfence PRISM
.