Medium severity · published Oct 28, 2026
CVE-2026-104694
Thrive Automator < 11.2 - Editor+ Blind SQLi via 'additional' Parameter
New
6.8
CVSS
–
EPSS
No
On KEV
Description
The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a parameter's array key before using it in a SQL query, allowing authenticated attackers with editor-level access to perform blind SQL injection attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TA
Thrive Automator ·
before 11.2 · source: vendor