CVE-2026-104694: Thrive Automator < 11.2 - Editor+ Blind SQLi via 'additional' Parameter

Q: Which installations should be prioritized for remediation?

Installations running Thrive Automator versions earlier than 11.2 should be prioritized, particularly where editor-level WordPress accounts are assigned to users who are not fully trusted.

Q: What level of access does an attacker need?

An attacker must be authenticated to WordPress and have editor-level access. The issue enables blind SQL injection through the affected parameter's array key.

Published Oct 28, 2026

Updated

The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a parameter's array key before using it in a SQL query, allowing authenticated attackers with editor-level access to perform blind SQL injection attacks.

Affected Software

1 affected component

Thrive Themes Thrive Automator<11.2

Event History

Oct 28, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which installations should be prioritized for remediation?

Installations running Thrive Automator versions earlier than 11.2 should be prioritized, particularly where editor-level WordPress accounts are assigned to users who are not fully trusted.

What level of access does an attacker need?

An attacker must be authenticated to WordPress and have editor-level access. The issue enables blind SQL injection through the affected parameter's array key.

CVE-2026-104694: Thrive Automator < 11.2 - Editor+ Blind SQLi via 'additional' Parameter

Affected Software

Event History

Frequently Asked Questions

Which installations should be prioritized for remediation?

What level of access does an attacker need?

Company

Resources

Contact

Frequently Asked Questions

Which installations should be prioritized for remediation?

What level of access does an attacker need?