The vulnerability is a classic Cross‑Site Request Forgery flaw that allows a malicious site to send authenticated requests to the WordPress site without the victim’s consent. Because the plugin does not properly validate request origin or include a protected token, an attacker can trigger any action that a logged‑in user could perform, potentially leading to unwanted changes, data loss, or other unintended behavior. The weakness is categorized as CWE‑352, a standard CSRF vulnerability.

WordPress sites running the ThimCore plugin by ThimPress version 2.3.3 or earlier are affected. The problem exists from the plugin’s earliest available version through 2.3.3, with no known fix in those releases.

The CVSS score of 4.3 indicates a moderate severity. The EPSS score of less than 1% suggests that real‑world exploitation is unlikely at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require a user to visit a crafted page while authenticated, or otherwise deliver a malicious request to the affected WordPress instance. No privileged access is required beyond the status of the victim user.