CVE-2025-53346

Vulnerability

Thim Core versions up to and including 2.3.3 contain a missing authorization vulnerability. This flaw allows for the exploitation of incorrectly configured access control security levels within the plugin.

Exploitation

An attacker can exploit this vulnerability by leveraging a missing authorization, authentication, or nonce token check in a function. This allows an unprivileged user to execute actions typically reserved for higher-privileged users.

Impact

Successful exploitation of this vulnerability could allow an unprivileged user to perform higher-privileged actions, potentially leading to unauthorized data access or modification depending on the specific function affected.

Mitigation

Update the Thim Core plugin to a version later than 2.3.3. If an update is not immediately possible, seek assistance from your hosting provider or web developer. This vulnerability is noted to be used in mass-exploit campaigns [1].