Index: wp-includes/query.php
===================================================================
--- wp-includes/query.php	(revision 13459)
+++ wp-includes/query.php	(working copy)
@@ -2021,6 +2021,7 @@
 			if ( !empty($q['meta_key']) ) {
 				$allowed_keys[] = $q['meta_key'];
 				$allowed_keys[] = 'meta_value';
+				$allowed_keys[] = 'meta_value_num';
 			}
 			$q['orderby'] = urldecode($q['orderby']);
 			$q['orderby'] = addslashes_gpc($q['orderby']);
@@ -2028,9 +2029,14 @@
 			if ( empty($orderby_array) )
 				$orderby_array[] = $q['orderby'];
 			$q['orderby'] = '';
+
 			for ($i = 0; $i < count($orderby_array); $i++) {
+				$orderby = $orderby_array[$i];
+
 				// Only allow certain values for safety
-				$orderby = $orderby_array[$i];
+				if ( ! in_array($orderby, $allowed_keys) )
+					continue;
+
 				switch ($orderby) {
 					case 'menu_order':
 						break;
@@ -2044,15 +2050,19 @@
 					case 'meta_value':
 						$orderby = "$wpdb->postmeta.meta_value";
 						break;
+					case 'meta_value_num':
+						$orderby = "$wpdb->postmeta.meta_value+0";
+						break;
 					case 'comment_count':
 						$orderby = "$wpdb->posts.comment_count";
 						break;
 					default:
 						$orderby = "$wpdb->posts.post_" . $orderby;
 				}
-				if ( in_array($orderby_array[$i], $allowed_keys) )
-					$q['orderby'] .= (($i == 0) ? '' : ',') . $orderby;
+
+				$q['orderby'] .= (($i == 0) ? '' : ',') . $orderby;
 			}
+
 			// append ASC or DESC at the end
 			if ( !empty($q['orderby']))
 				$q['orderby'] .= " {$q['order']}";