WordPress Thim Core Plugin <= 2.3.3 - Cross Site Request Forgery (CSRF) Vulnerability

The CSRF vulnerability in Thim Core allows an attacker to craft malicious requests that appear to originate from a legitimate user. Successful exploitation could lead to unauthorized modifications of user profiles, changes to site settings, or other actions depending on the functionality exposed through the Thim Core plugin. The attacker does not need to authenticate as the target user; they simply need to trick the user's browser into executing the malicious request while the user is authenticated. This could be achieved through phishing emails, malicious websites, or compromised advertisements.

Websites using Thim Core plugin versions prior to 2.4.0 are at risk. Specifically, sites with user roles that have administrative privileges are particularly vulnerable, as an attacker could leverage CSRF to escalate their privileges.

• wordpress / composer / npm:

grep -r 'thim_core_settings' /var/www/html/

• generic web:

curl -I https://your-wordpress-site.com/wp-admin/admin-ajax.php?action=thim_core_settings&nonce=malicious_nonce | grep -i '200 ok'

1. 2026-01-05Disclosure

   disclosure

1. Reserviert2025-06-27
2. Veröffentlicht2026-01-05
3. Geändert2026-04-28
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-53344 is to upgrade Thim Core to version 2.4.0 or later, which includes the necessary fix. If upgrading is not immediately feasible, consider implementing a Content Security Policy (CSP) to restrict the sources from which scripts can be executed. Additionally, ensure that all sensitive actions require explicit user confirmation, such as a password re-entry or a confirmation dialog. Web Application Firewalls (WAFs) can be configured to detect and block malicious CSRF requests, although this is not a substitute for patching the vulnerability.