thimpress Vulnerabilities and Affected Products
Vulnerabilities associated with Thim Core.
Products
Clear product- LearnPress – WordPress LMS Plugin for Create and Sell Online Courses37 vulnerabilities
- learnpress30 vulnerabilities
- WP Hotel Booking17 vulnerabilities
- WP Pipes9 vulnerabilities
- LearnPress Export Import5 vulnerabilities
- wp_hotel_booking5 vulnerabilities
- Eduma4 vulnerabilities
- LearnPress – Backup & Migration Tool4 vulnerabilities
- Thim Elementor Kit4 vulnerabilities
- LearnPress – WordPress LMS Plugin3 vulnerabilities
- Thim Core3 vulnerabilities
- RealPress2 vulnerabilities
- Sailing2 vulnerabilities
- Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor2 vulnerabilities
- WP Events Manager2 vulnerabilities
- BuilderPress1 vulnerability
- Course Builder1 vulnerability
- FundPress1 vulnerability
- FundPress – WordPress Donation Plugin1 vulnerability
- Ivy School1 vulnerability
- LearnPress – Course Review1 vulnerability
- LearnPress – Sepay Payment1 vulnerability
- Resca1 vulnerability
- Thim Blocks1 vulnerability
- wp_events_manager1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-53346MEDIUM | WordPress Thim Core Plugin <= 2.3.3 - Broken Access Control VulnerabilityMissing Authorization vulnerability in ThimPress Thim Core allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Thim Core: from n/a through 2.3.3. CWE-862Jun 2, 2026 | CVSS4.3v3.1 | EPSS0.152% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-53345HIGH | WordPress Thim Core plugin <= 2.3.3 - Arbitrary Plugin Installation vulnerabilityMissing Authorization vulnerability leading to code execution after installing malicious vulnerable plugin in ThimPress Thim Core. This issue affects Thim Core: from n/a through 2.3.3. CWE-862Jun 2, 2026 | CVSS8.8v3.1 | EPSS0.302% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-53344MEDIUM | WordPress Thim Core Plugin <= 2.3.3 - Cross Site Request Forgery (CSRF) VulnerabilityCross-Site Request Forgery (CSRF) vulnerability in ThimPress Thim Core allows Cross Site Request Forgery.This issue affects Thim Core: from n/a through 2.3.3. CWE-352Jan 5, 2026 | CVSS4.3v3.1 | EPSS0.102% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |