The vulnerability in ThimPress Thim Elementor Kit allows an attacker to bypass authorization checks when interacting with the plugin’s functionality. This results in the ability to gain unauthorized access to admin-level features, potentially exposing sensitive content, modifying settings, or executing unintended actions. It is classified under CWE-862: Missing Authorization.

Affects WordPress sites using the Thim Elementor Kit plugin version 1.2.8 or earlier. The issue applies to all installations that have not yet updated beyond this version.

The CVSS score of 4.3 indicates a moderate impact, and the EPSS score of less than 1% suggests a low probability of exploitation in the near term. It is not listed in the CISA KEV catalog. While no direct exploitation method is detailed, the likely attack vector is through web requests to plugin endpoints that do not impose correct role checks, as inferred from the description of missing authorization.