CVE-2025-53345: Thim Core Auth Bypass Vulnerability

CVE-2025-53345 Overview

CVE-2025-53345 is a missing authorization vulnerability [CWE-862] in the ThimPress Thim Core plugin for WordPress. The flaw affects all versions up to and including 2.3.3. Authenticated attackers with low privileges can abuse missing capability checks to install a malicious or vulnerable plugin, which then enables arbitrary code execution on the WordPress host. The vulnerability is reachable over the network and requires no user interaction.

Critical Impact
An authenticated low-privilege user can install an attacker-controlled plugin through Thim Core, achieving arbitrary code execution and full compromise of the WordPress site.

Affected Products

ThimPress Thim Core plugin for WordPress
All versions from initial release through 2.3.3
WordPress sites running themes that bundle Thim Core (commonly Eduma, Ivy School, Coaching)

Discovery Timeline

2026-06-02 - CVE-2025-53345 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2025-53345

Vulnerability Analysis

The vulnerability stems from an authorization gap in Thim Core's plugin handling routines. The plugin exposes functionality to install additional plugins but fails to verify that the calling user holds the required WordPress capability, typically install_plugins or manage_options. Any authenticated session, including low-privilege roles such as Subscriber or Contributor, can reach the vulnerable endpoint and trigger plugin installation.

Once a malicious plugin is installed and activated through this path, its PHP code executes within the WordPress process. This converts a missing access control flaw into arbitrary code execution on the underlying web server. The attacker gains the same privileges as the PHP process, which is sufficient to read configuration files, modify site content, pivot to the database, or stage persistent webshells.

Root Cause

The root cause is a missing authorization check [CWE-862] on a plugin installation handler exposed by Thim Core. The handler accepts plugin source input from the request but does not validate the user's capability or restrict the source to a trusted catalog of legitimate companion plugins.

Attack Vector

Exploitation requires a valid authenticated session on the target WordPress site. The attacker sends a crafted request to the vulnerable Thim Core endpoint, supplying a reference to an attacker-controlled plugin archive. The plugin is fetched, installed, and executed. No administrator interaction is needed, and the attack is fully remote over HTTP/HTTPS. Refer to the Patchstack Advisory for Thim Core for advisory-level technical details.

Detection Methods for CVE-2025-53345

Indicators of Compromise

Unexpected plugins appearing under wp-content/plugins/ that were not deployed by administrators.
New PHP files with obfuscated content, eval, base64_decode, or assert usage inside plugin directories.
WordPress audit log entries showing plugin installation actions performed by non-administrator accounts.
Outbound HTTP requests from the WordPress host fetching ZIP archives from unfamiliar domains during installation events.

Detection Strategies

Compare the active plugin list against a known-good baseline and alert on any additions outside the change-management process.
Monitor web access logs for POST requests targeting Thim Core admin-ajax actions originating from low-privilege user sessions.
Inspect file integrity monitoring output for new or modified files under wp-content/plugins/ and wp-content/uploads/.

Monitoring Recommendations

Forward WordPress, web server, and PHP-FPM logs into a centralized analytics platform for correlation across sessions and file events.
Alert on PHP processes spawning shell utilities such as sh, bash, curl, or wget from within the web root.
Track plugin installation and activation events and require approval workflows for non-administrator triggered changes.

How to Mitigate CVE-2025-53345

Immediate Actions Required

Identify all WordPress sites running Thim Core 2.3.3 or earlier, including sites where the plugin is bundled with a ThimPress theme.
Update Thim Core to a fixed version above 2.3.3 as published by ThimPress and referenced in the Patchstack advisory.
Audit the plugin directory and user account list for unauthorized plugins or recently created low-privilege accounts.
Rotate WordPress administrator credentials, secret keys in wp-config.php, and any API tokens stored on the host.

Patch Information

ThimPress has issued a fixed release that adds proper capability checks to the affected plugin installation handler. Administrators should upgrade Thim Core to the latest version available through the ThimPress dashboard or the bundled theme update mechanism. Consult the Patchstack Advisory for Thim Core for the current fixed version reference.

Workarounds

Disable and remove Thim Core until the patched version can be deployed, accepting the loss of dependent theme features.
Restrict access to wp-admin/ and admin-ajax.php by source IP using web server or WAF rules while patching is in progress.
Reduce user registration risk by disabling open signups and removing unnecessary low-privilege accounts.

bash

# Configuration example
# Restrict admin-ajax.php to trusted networks at the nginx layer
location = /wp-admin/admin-ajax.php {
    allow 203.0.113.0/24;
    deny all;
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}