CVE-2026-1870mediumCWE-862

CVE-2026-1870: medium-severity vulnerability in thimpress Thim Kit for Elementor – Pre-built…

Thim Kit for Elementor <= 1.3.7 - Missing Authorization to Unauthenticated Private Course Disclosure

Published · Updated

Follow this CVE+ Monitor Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.3%
The Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing validation checks on the 'thim-ekit/archive-course/get-courses' REST endpoint callback function in all versions up to, and including, 1.3.7. This makes it possible for unauthenticated attackers to disclose private or draft LearnPress course content by supplying post_status in the params_url payload.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
thimpress · Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor
Related CVEs — thimpress Thim Kit for Elementor – Pre-built…

In the same product, most dangerous first.

CVE-2024-4329MEDIUMThim Elementor Kit <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via id ParameterEPSS 0.4%