CVE-2026-12115: Counter Box WordPress Plugin PHP Object Injection Vulnerability

Technical summary

CVE-2026-12115 is a PHP Object Injection vulnerability (CWE-502) in the Counter Box WordPress plugin affecting versions up to and including 2.0.13. The vulnerability stems from unsafe deserialization of untrusted input during the import process and subsequent list table rendering and item editing operations. An authenticated attacker with administrator privileges can craft malicious serialized PHP objects that are automatically deserialized without validation. While the vulnerability itself provides a deserialization gadget, exploitation depends entirely on the presence of a Property-Oriented Programming (POP) chain in co-installed plugins or themes. If such a chain exists, attackers could achieve arbitrary file deletion, sensitive data exfiltration, or remote code execution. The automatic triggering upon import and edit operations eliminates the need for additional user interaction beyond the initial malicious import.

Business impact

Organizations using Counter Box face a two-layered risk. First, the vulnerability requires administrator-level access, limiting the immediate threat to compromised admin accounts or malicious insiders. Second, actual impact depends on the broader WordPress ecosystem—specifically what other plugins and themes are installed. Sites with only well-vetted, actively maintained plugins and themes may face minimal risk; however, sites running legacy, abandoned, or vulnerable themes or plugins alongside Counter Box could face complete compromise including data theft, site defacement, malware injection, or complete loss of availability. The automatic nature of the exploit (triggered on import without extra steps) means that once a malicious import file reaches an admin user, exploitation is difficult to prevent.

Affected systems

The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin in all versions up to and including 2.0.13 is affected. This is a WordPress plugin distributed through the official plugin repository, making it potentially accessible to any WordPress site. The vulnerability requires an authenticated attacker with administrator-level or higher privileges, and true impact is only realized if co-installed plugins or themes contain exploitable POP chains. The exact number of installations is not specified in available data; verify current usage statistics through WordPress.org plugin repository metrics.

Exploitability

Exploitation requires administrator-level access, which significantly limits attack surface compared to unauthenticated or lower-privilege vulnerabilities. However, admin compromise through other means (credential theft, plugin vulnerabilities, supply-chain attack) is not uncommon in WordPress environments. The CVSS score of 6.6 (MEDIUM) reflects the high privilege requirement (High Attack Complexity) balanced against high potential impact (Confidentiality, Integrity, and Availability all rated High if a POP chain exists). The critical dependency on the presence of a POP chain in other software components means real-world exploitability varies dramatically by site configuration. No known POP chains have been identified in Counter Box itself, but exploitation becomes practical the moment any vulnerable complementary plugin or theme is installed.

Remediation

Immediately update the Counter Box plugin to a patched version beyond 2.0.13. Verify the patched version through the official WordPress plugin repository or the plugin vendor's release notes. Until patched, restrict Counter Box's import functionality to trusted administrators only, and audit admin account access logs for suspicious import activity. Additionally, conduct a comprehensive review of all installed plugins and themes to identify and remove any with known deserialization gadgets (POP chains) or other critical vulnerabilities. Consider disabling the import feature entirely if it is not actively required.

Patch guidance

Check the WordPress plugin repository for Counter Box for available updates beyond version 2.0.13. Apply the latest available patch through the WordPress admin dashboard under Plugins > Installed Plugins, or manually download and install from WordPress.org. After patching, verify the new version number and test the plugin's core functionality (countdown and timer rendering) to ensure no regression. Document the patch application date and version number for compliance records. If no patch is yet available at the time of reading, monitor the vendor's release channels and plan an immediate update as soon as one is published.

Detection guidance

Monitor WordPress admin logs and audit trails for imports performed via the Counter Box plugin, particularly those conducted by users with administrator accounts that were recently compromised or showing unusual activity patterns. Check for suspicious serialized data patterns in import files—look for patterns like 'O:' prefixes in text-based imports that indicate object instantiation. Review server-side logs for PHP errors or fatal exceptions during import operations, which may indicate attempted exploitation. If your WordPress environment has centralized logging or a security information and event management (SIEM) system, create detection rules for Counter Box import events combined with PHP object deserialization warnings. Additionally, audit installed plugins and themes for known deserialization gadgets or CVEs that could serve as POP chains.

Why prioritize this

This vulnerability should be prioritized based on your WordPress ecosystem composition. If your site runs only Counter Box with well-maintained, actively supported plugins and themes, remediation can follow a standard patch cadence (within 1–2 weeks). However, if your site runs legacy themes, abandoned plugins, or software with known vulnerabilities, prioritize this as urgent because the attack chain is now complete and realistic. The authentication requirement and dependency on POP chains mean this is lower priority than unauthenticated vulnerabilities, but the automatic exploitation on import and high potential impact (data theft, code execution) justify prompt attention.

Risk score, explained

The CVSS 3.1 score of 6.6 (MEDIUM) reflects a vulnerability with high potential impact (all three impact metrics scored High) but significant barriers to exploitation: administrator-level privileges required (High Attack Complexity due to privilege requirement) and no impact without a POP chain in co-installed software. The network-accessible vector and no user interaction requirement acknowledge that the import can be triggered by an authenticated admin without additional clicks. The score appropriately downgrades from CRITICAL due to the privilege barrier and POP chain dependency, landing in the MEDIUM range. Organizations should consider contextual factors: sites with vulnerable co-installed plugins should treat this as higher priority than the numerical score alone suggests.

Frequently asked questions