Description
The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a parameter's array key before using it in a SQL query, allowing authenticated attackers with editor-level access to perform blind SQL injection attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Thrive Automator | < 11.2 | 11.2 |
References
- https://wpscan.com/vulnerability/ad8f60bb-ee1d-4472-92fa-e4e22fed1471/ exploit vdb-entry technical-description