The Animated Number Counters plugin for WordPress contains a second‑order SQL injection vulnerability triggered via the "counterid" parameter. The plugin correctly sanitizes input when writing data, but the same sanitization is not applied when reading data, resulting in an unsanitized query that allows an attacker to append arbitrary SQL code. If successfully exploited, an attacker can read any table from the database, exposing sensitive information such as user credentials, posts, and configuration settings.

This flaw affects every installation of the Animated Number Counters plugin for WordPress with a version of 3.0 or earlier. The vendor listed by the CNA is WPMart, and the affected product is the Animated Number Counters plugin. No version exclusions are specified other than the upper bound of 3.0.

The CVSS score of 4.9 classifies the vulnerability as moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. To exploit the flaw, an attacker must be authenticated to the WordPress site with at least editor-level privileges and supply a malicious value for the counterid parameter through the plugin's administrative interface. This second‑order SQL injection does not rely on network-level exploits or client side manipulation; the needed conditions are application‑level access and insufficient input sanitization.