Vulnerability · Published Mar 14, 2026 · Assigned by Wordfence

CVE-2026-1870Thim Kit for Elementor <= 1.3.7 - Missing Authorization to Unauthenticated Private Course Disclosure

Medium 5.3

In plain English

A medium-severity missing authorization in Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor from thimpress. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 80.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing validation checks on the 'thim-ekit/archive-course/get-courses' REST endpoint callback function in all versions up to, and including, 1.3.7. This makes it possible for unauthenticated attackers to disclose private or draft LearnPress course content by supplying post_status in the params_url payload.

Affected products (as reported)

Vendor	Product	Versions
thimpress	Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor	0 – through 1.3.7

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

In plain English

Official description

Affected products (as reported)

References