CVE-2025-53345: ThimPress Thim Core Missing Authorization Leads to Code Execution

Technical summary

CVE-2025-53345 is a CWE-862 (Missing Authorization) vulnerability in ThimPress Thim Core versions through 2.3.3. The vulnerability stems from inadequate authorization checks when handling plugin installation requests. An authenticated user can submit a malicious plugin without proper validation of their permissions, and the system executes the plugin code with insufficient sandboxing or verification. The CVSS 3.1 score of 8.8 (HIGH severity) reflects the combination of network accessibility, low attack complexity, requirement for authenticated access, and the severe impact: full compromise of confidentiality, integrity, and availability on the affected server.

Business impact

Organizations using ThimPress Thim Core face a significant operational risk. If an attacker compromises any user account—whether through credential stuffing, phishing, or insider threat—they can immediately escalate to arbitrary code execution on the web server. This enables data exfiltration, website defacement, malware injection targeting visitors, or lateral movement into the broader network infrastructure. For WordPress-based business websites, this creates a critical supply chain risk if the compromised installation is used to serve content to customers or partners.

Affected systems

ThimPress Thim Core versions up to and including 2.3.3 are affected. Organizations should audit their WordPress installations for this plugin and verify the installed version. The vulnerability requires an authenticated user to trigger, so it does not pose a direct risk to unauthenticated attackers unless user credentials are compromised or accounts have been created for untrusted parties.

Exploitability

Exploitation requires valid user credentials to access the WordPress admin interface. The attack complexity is low—once authenticated, an attacker can craft and upload a malicious plugin without specialized technical knowledge. No user interaction is needed beyond the initial login. The absence of this CVE from CISA's Known Exploited Vulnerabilities catalog does not guarantee the absence of active exploitation; it indicates only that as of the query date, exploitation has not been formally documented in that particular government database.

Remediation

Update ThimPress Thim Core to the patched version released after 2.3.3. Verify the exact patched version by consulting the official ThimPress plugin repository or security advisory. As an interim control pending patching, restrict plugin installation permissions to administrators only, disable plugin upload for non-admin roles if possible, and monitor admin user activity for unauthorized plugin installations.

Patch guidance

Check the WordPress plugin directory or ThimPress's official support channel for the latest version. Update to the first released version after 2.3.3 that addresses CVE-2025-53345. Test the update in a staging environment before deploying to production. Also review and revoke any suspicious plugin installations that may have occurred prior to patching. Document the patch deployment timestamp for audit and compliance records.

Detection guidance

Monitor WordPress admin activity logs for plugin installation events, especially installations initiated by users other than your expected administrators. Alert on any plugin uploads from accounts that do not routinely perform maintenance. Use WordPress security plugins or host-level file integrity monitoring to detect unauthorized PHP files or plugin directories. Search your file system for plugins modified or created around the time of suspected compromise. Additionally, review HTTP request logs for POST requests to plugin installation endpoints with unusual parameters or timing patterns.

Why prioritize this

This vulnerability merits rapid remediation despite not appearing on CISA's KEV list. The HIGH CVSS score, combined with the post-authentication code execution impact and the prevalence of WordPress as a target, makes this a priority for any organization running ThimPress Thim Core. The attack is straightforward to execute if user credentials are available, and the consequences—full server compromise—are severe. Organizations should treat this similarly to a CRITICAL-severity patch if they have multiple admin-level accounts or if their user base includes contractors or vendors.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: (1) Network accessibility and low attack complexity favor the attacker; (2) Requirement for authenticated access (PR:L) prevents completely unauthenticated exploitation, preventing a 9.0+ rating; (3) Full impact on confidentiality, integrity, and availability (C:H, I:H, A:H) due to unrestricted code execution; (4) No scope escalation required. The HIGH severity rating is appropriate for a post-authentication code execution flaw affecting web applications.

Frequently asked questions