Junglewise Threat Intelligence

CVE-2026-12115: wpcalc Counter Box PHP Object Injection via deserialization

CVE-2026-12115 · Severity: medium · CVSS 6.6 · Published 2026-06-17

Executive brief

The Counter Box plugin for WordPress, which provides countdowns and timers for websites, contains a security flaw that could allow an administrator to execute malicious code. By importing specially crafted data, an attacker with high-level access can trigger the vulnerability, potentially leading to full site takeover or data theft. This risk is highest if the website also uses other plugins or themes with specific coding weaknesses that the attacker can chain together.

Technical details

The Counter Box plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted input in all versions up to and including 2.0.13. The vulnerability exists because the plugin fails to properly sanitize data during the import process and subsequent rendering of list tables or item editing. An authenticated attacker with administrator-level privileges can inject a PHP Object. While the plugin itself does not contain a known Property-Oriented Programming (POP) chain, the presence of one in other installed themes or plugins could allow for remote code execution, sensitive data retrieval, or arbitrary file deletion. The deserialization is triggered automatically during post-import redirects or when opening items for editing.

Affected products

  • wpcalc Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress up to, and including, 2.0.13

Timeline

  • 2026-06-17: disclosed
  • 2026-06-17: advisory

References