Live › vulnerability › CVE-2026-104694
Go to dashboardThe Thrive Automator WordPress plugin before 11.2 does not sanitize a parameter's array key before using it in a SQL query. An authenticated user with editor-level access can use this to run blind SQL injection and read database contents.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Sites running the Thrive Automator WordPress plugin before 11.2 are exposed. The attacker needs an editor-level account, so sites that give editor accounts only to trusted staff have lower exposure. Sites without this plugin are not affected.
No product ranges from the sources yet.
11.2 are affected.wp plugin get thrive-automator --field=version if WP-CLI is available (plugin slug unknown from sources; confirm with wp plugin list).11.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a parameter's array key before using it in a SQL query, allowing authenticated attackers with editor-level access to perform blind SQL injection attacks.
This page as .md · .json · in your agent: get_signal("CVE-2026-104694")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.