# CVE-2025-53346: ThimPress Thim Core missing authorization in access control

Source: https://junglewise.ai/threats/cve-2025-53346-thimpress-thim-core-missing-authorization-in-access-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-02. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2025-53346 · Severity: medium · CVSS 4.3 · Published 2026-06-02

Thim Core, a foundational WordPress plugin used by ThimPress themes, contains a security flaw in its access control mechanisms. This vulnerability allows logged-in users with low-level permissions, such as subscribers, to perform actions they should not be authorized to access. While the impact is considered low, it could lead to unauthorized configuration changes or minor operational disruptions on affected websites.

Vendors: [ThimPress](https://junglewise.ai/threats/vendors/thimpress).

## Quick answers

**Is CVE-2025-53346 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-53346 being exploited in the wild.

**How severe is CVE-2025-53346?** Medium severity, with a CVSS score of 4.3, published 2 June 2026.

**Which products and versions are affected?** ThimPress Thim Core <= 2.3.3.

**Is there a fix for CVE-2025-53346?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-53346 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-53346?** Check whether you run ThimPress Thim Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization vulnerability (CWE-862) exists in the ThimPress Thim Core plugin for WordPress through version 2.3.3. The flaw stems from incorrectly configured access control security levels within the plugin's functional logic. An attacker authenticated with low-level privileges (Subscriber-level) can exploit this to execute functions or access settings that should be restricted to higher-privileged roles. The attack vector is network-based and requires no user interaction, though it does require valid low-level credentials. As of the advisory date, no official patch has been confirmed.

## Affected products

- ThimPress Thim Core <= 2.3.3

## Timeline

- 2024-11-13: other: Reported by researcher Ananda Dhakal
- 2025-08-14: advisory: Early warning and publication by Patchstack
- 2026-06-02: disclosed: CVE published to NVD

## References

- [https://patchstack.com/database/wordpress/plugin/thim-core/vulnerability/wordpress-thim-core-plugin-plugin-2-3-3-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/thim-core/vulnerability/wordpress-thim-core-plugin-plugin-2-3-3-broken-access-control-vulnerability?_s_id=cve)

## Related threats

- [ThimPress Thim Core missing authorization leading to code execution](https://junglewise.ai/threats/cve-2025-53345-thimpress-thim-core-missing-authorization-leading-to-code)