CVE-2026-15399: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in wpmart Animated Number Counters

CVE-2026-15399 describes a second-order SQL injection vulnerability in the Animated Number Counters plugin for WordPress, affecting all versions up to and including 3.0. The issue arises because although the write path uses $wpdb->prepare() correctly, the read path concatenates the stored value unsanitized into unprepared SQL queries, both in single-quoted string and numeric contexts. This improper neutralization of special elements in SQL commands (CWE-89) enables authenticated attackers with editor-level access or higher to append arbitrary SQL queries, potentially extracting sensitive data from the database.

An attacker with editor-level or higher privileges can exploit this vulnerability to extract sensitive information from the database. The vulnerability does not allow modification or deletion of data (no integrity or availability impact), but the confidentiality of the database contents is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict editor-level access to trusted users only and monitor for suspicious activity related to the 'counterid' parameter. Avoid using the vulnerable plugin version in sensitive environments.