CVE-2025-53344
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The Thim Core plugin by ThimPress contains a Cross-Site Request Forgery vulnerability in versions from n/a through 2.3.3. This vulnerability allows an attacker to leverage CSRF to perform unauthorized actions in the context of a logged-in administrator.
Risk Assessment
The risk involves the possibility of performing unauthorized administrative operations, such as changing plugin settings, which could compromise site integrity.
Recommendation
Update the Thim Core plugin to a version newer than 2.3.3 that includes CSRF protections.
Other vulnerabilities in Thim Core
See all- CVE-2025-53346Medium
Missing authorization in the Thim Core plugin (versions up to 2.3.3) allows exploiting incorrectly configured access control security levels.
- CVE-2025-53345High
The Thim Core plugin for WordPress (versions up to 2.3.3) contains a missing authorization vulnerability. This means that unauthorized users can perform operations requiring privileges, potentially leading to unauthorized access to administrative functions.
Original NVD description (English source)
Cross-Site Request Forgery (CSRF) vulnerability in ThimPress Thim Core allows Cross Site Request Forgery.This issue affects Thim Core: from n/a through 2.3.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS