{"id":"CVE-2026-104694","title":"Thrive Automator < 11.2 - Editor+ Blind SQLi via 'additional' Parameter","summary":"The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a parameter's array key before using it in a SQL query, allowing authenticated attackers with editor-level access to perform blind SQL injection atta…","severity":"medium","cvss":6.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","cvssSource":"adp","cwe":["CWE-89"],"product":"Thrive Automator","affected":["thrive_automator < 11.2"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-28T17:49:10.819094Z"},"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T17:58:09.090Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-104694","references":[{"url":"https://wpscan.com/vulnerability/ad8f60bb-ee1d-4472-92fa-e4e22fed1471/"}],"tags":["cve.org"],"epss":0.00297,"epssPercentile":0.22567,"ingestedAt":"2026-10-28T07:06:27.161Z","slug":"CVE-2026-104694","body":"## Overview\n\nThe Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a parameter's array key before using it in a SQL query, allowing authenticated attackers with editor-level access to perform blind SQL injection attacks.\n\n## Affected\n\n- `thrive_automator < 11.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":37.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":230776,"id":"CVE-2026-104694","ts":1793211382940,"field":"cvss","old":null,"new":"6.8"},{"seq":230775,"id":"CVE-2026-104694","ts":1793211382940,"field":"severity","old":"none","new":"medium"}]}