CVE-2025-53346
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Missing authorization in the Thim Core plugin (versions up to 2.3.3) allows exploiting incorrectly configured access control security levels.
Risk Assessment
An attacker may gain unauthorized access to administrative functions or data, leading to privilege escalation.
Recommendation
Update the Thim Core plugin to the latest available version.
Other vulnerabilities in Thim Core
See all- CVE-2025-53345High
The Thim Core plugin for WordPress (versions up to 2.3.3) contains a missing authorization vulnerability. This means that unauthorized users can perform operations requiring privileges, potentially leading to unauthorized access to administrative functions.
- CVE-2025-53344Medium
The Thim Core plugin by ThimPress contains a Cross-Site Request Forgery vulnerability in versions from n/a through 2.3.3. This vulnerability allows an attacker to leverage CSRF to perform unauthorized actions in the context of a logged-in administrator.
Original NVD description (English source)
Missing Authorization vulnerability in ThimPress Thim Core allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Thim Core: from n/a through 2.3.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS