CVE-2025-67594: 
WordPress vulnerability analysis and mitigation

CVE-2025-67594 is an Authorization Bypass Through User-Controlled Key (IDOR) vulnerability in the ThimPress Thim Elementor Kit WordPress plugin. It allows authenticated attackers to exploit incorrectly configured access control security levels by manipulating user-controlled keys to access or modify resources they should not be authorized to reach. The vulnerability affects all versions of the Thim Elementor Kit plugin up to and including version 1.3.3. It was published on December 9, 2025, and carries a CVSS v3.1 base score of 4.3 (Medium), assigned by Patchstack (Feedly).

The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), commonly known as an Insecure Direct Object Reference (IDOR). An authenticated attacker with low privileges can manipulate object references — such as IDs or keys passed in requests — to bypass access controls and interact with resources belonging to other users or restricted areas. Exploitation requires network access, low privileges, no user interaction, and low attack complexity, making it straightforward for any authenticated WordPress user to attempt (Feedly).

Successful exploitation primarily affects availability, with a low availability impact, while confidentiality and integrity are not impacted according to the CVSS scoring. An authenticated attacker could abuse the IDOR flaw to perform unauthorized actions on objects or resources within the WordPress site managed by the Thim Elementor Kit plugin, potentially disrupting site functionality or content. The scope is limited to the affected system without lateral movement potential beyond the WordPress installation (Feedly).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-67594 at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.046%, indicating a very low probability of exploitation in the near term (Feedly).

Users of the Thim Elementor Kit WordPress plugin should update to a version beyond 1.3.3 as soon as a patched release is made available by ThimPress. In the interim, site administrators should consider restricting access to the plugin's functionality to trusted user roles only, and monitor for unexpected access patterns in WordPress logs. Reviewing and hardening WordPress user role permissions can also reduce the attack surface (Feedly).