{"id":"CVE-2026-104667","revision":"5a9c2989064140ea8e0f8683bea15108","records":[{"revision":"5a9c2989064140ea8e0f8683bea15108","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-104667","aliases":[],"title":"Animated Number Counters < 3.1 - Editor+ Second-Order SQLi via Counter Order","description":"The Animated Number Counters WordPress plugin before 3.1 does not sanitise or escape a value stored by an Editor-level user before concatenating it into a SQL query that runs when any unauthenticated visitor renders a page containing the counter, leading to second-order SQL injection that can read arbitrary data including password hashes.","state":0,"publishedAt":"2026-10-07T06:00:05.773+00:00","modifiedAt":"2026-10-07T09:56:28.389+00:00","affected":[{"ecosystem":"Vendor product","name":"Animated Number Counters","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"Animated Number Counters\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.1\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://wpscan.com/vulnerability/ccaedf47-6a6b-429b-aae9-3b4254181dd9/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-104667","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-104667","identifiers":["CVE-2026-104667"]},"retained":false,"historicalAffected":[]}],"coverage":[]}