CVE-2026-104694

Name of the Vulnerable Software and Affected Versions Thrive Automator versions prior to 11.2

Description Authenticated attackers with editor-level access or higher can perform blind SQL injection attacks. This occurs because the plugin fails to properly sanitize and escape an array key within a user-supplied parameter before incorporating it into a SQL query. This flaw allows attackers to append additional SQL queries to existing ones to extract sensitive information from the database.

Recommendations Update to version 11.2 or later.