Thrive Automator CVE-2026-104694

Requires an authenticated WordPress account with editor-level role or higher (per PR:H); the attacker then supplies a request parameter whose array KEY is not sanitized or escaped before being used in a SQL query, enabling blind SQL injection against versions of Thrive Automator before 11.2. The primary limiting factor is the editor privilege prerequisite - exploitation is not available to anonymous or low-privilege (subscriber/contributor) users - which substantially narrows the realistic attacker set to insiders or already-compromised editor accounts. No special non-default plugin configuration is indicated by the description; the vulnerable code path appears present in affected default installs.

This is a moderate-priority, not an urgent, issue. The CVSS vector (AV:N/AC:L/PR:H/UI:N) shows a network-reachable, low-complexity flaw, but the PR:H requirement is the dominant mitigating signal: exploitation requires an already-authenticated account at editor level, so this is a privilege-escalation/data-exposure risk from semi-trusted insiders rather than an anonymous internet attack. The multi-source signals are mutually consistent and point to low real-world urgency: EPSS is 0.18% (8th percentile), there is no CISA KEV listing, and no public exploit is identified in the provided data. The vuln.today decision label is 'this_month', not act_now or emergency, which aligns with the low EPSS and absence of active exploitation. One point to verify independently: the input CVSS sets S:C (scope changed) and C:H, which inflates the base score to 6.8; for a blind SQL injection confined to the WordPress database I would assess scope as unchanged, which would lower the score - the severity inflation is worth noting but does not change the operational conclusion. Overall: a real but non-emergency flaw whose practical exposure is bounded by the editor-privilege prerequisite.

An attacker who already holds (or has compromised) an editor-level WordPress account submits a request to the Thrive Automator plugin in which a parameter's array key is crafted to inject SQL. Because the injection is blind, the attacker infers database contents (e.g., user records, password hashes, secrets) through boolean/time-based responses rather than direct output. No public exploit code is identified in the available data, and exploitation requires the editor privilege level indicated by PR:H.