{"id":"CVE-2026-104694","revision":"8f9bfd2e508e460b85c1f0d56f1b45ea","records":[{"revision":"8f9bfd2e508e460b85c1f0d56f1b45ea","observedAt":"2026-10-28T18:46:48.818+00:00","statement":{"source":"cve-program","id":"CVE-2026-104694","aliases":[],"title":"Thrive Automator < 11.2 - Editor+ Blind SQLi via 'additional' Parameter","description":"The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a parameter's array key before using it in a SQL query, allowing authenticated attackers with editor-level access to perform blind SQL injection attacks.","state":0,"publishedAt":"2026-10-28T06:00:20.983+00:00","modifiedAt":"2026-10-28T17:58:09.09+00:00","affected":[{"ecosystem":"Vendor product","name":"Thrive Automator","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"Thrive Automator\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"11.2\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://wpscan.com/vulnerability/ad8f60bb-ee1d-4472-92fa-e4e22fed1471/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-104694","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-104694","identifiers":["CVE-2026-104694"]},"retained":false,"historicalAffected":[]}],"coverage":[]}