CVE-2025-53345
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The Thim Core plugin for WordPress (versions up to 2.3.3) contains a missing authorization vulnerability. This means that unauthorized users can perform operations requiring privileges, potentially leading to unauthorized access to administrative functions.
Risk Assessment
The risk includes the possibility of unauthorized modification of plugin or site settings, potentially leading to site integrity compromise and potential takeover.
Recommendation
It is recommended to immediately update the Thim Core plugin to the latest available version that includes a fix. Also, regularly review user permissions and restrict access to the admin panel.
Other vulnerabilities in Thim Core
See all- CVE-2025-53346Medium
Missing authorization in the Thim Core plugin (versions up to 2.3.3) allows exploiting incorrectly configured access control security levels.
- CVE-2025-53344Medium
The Thim Core plugin by ThimPress contains a Cross-Site Request Forgery vulnerability in versions from n/a through 2.3.3. This vulnerability allows an attacker to leverage CSRF to perform unauthorized actions in the context of a logged-in administrator.
Original NVD description (English source)
Missing Authorization vulnerability in ThimPress Thim Core thim-core.This issue affects Thim Core: from n/a through 2.3.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS