CVE-2026-1870

🗓️ 14 Mar 2026 13:24:42Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 15 Views🌐 WEB

Unauthenticated disclosure of private LearnPress courses via course endpoint in Thim Kit Elementor up to version 1.3.7.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2026-1870	14 Mar 202613:24	–	attackerkb
CNNVD	WordPress plugin Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor 安全漏洞	16 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-1870 Thim Kit for Elementor <= 1.3.7 - Missing Authorization to Unauthenticated Private Course Disclosure	14 Mar 202613:24	–	cvelist
EUVD	EUVD-2026-12184	16 Mar 202615:30	–	euvd
NVD	CVE-2026-1870	16 Mar 202614:18	–	nvd
Patchstack	WordPress Thim Kit for Elementor plugin <= 1.3.7 - Missing Authorization to Unauthenticated Private Course Disclosure vulnerability	16 Mar 202619:57	–	patchstack
Positive Technologies	PT-2026-25505	14 Mar 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-1870	26 Mar 202615:10	–	redhatcve
Vulnrichment	CVE-2026-1870 Thim Kit for Elementor <= 1.3.7 - Missing Authorization to Unauthenticated Private Course Disclosure	14 Mar 202613:24	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (March 9, 2026 to March 15, 2026)	19 Mar 202616:12	–	wordfence

Vulners

Node

thimpress thim_kit_for_elementor_pre-built_templates_&_widgets_for_elementorRange≤1.3.7wordpress

[
  {
    "vendor": "thimpress",
    "product": "Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.3.7",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/3467195/thim-elementor-kit
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/7c82577a-e7ee-4549-8d0f-bed09effa035

Parameter	Position	Path	Description	CWE
params_url	query param	thim-ekit/archive-course/get-courses	Unauthorized access to private or draft LearnPress course content due to missing validation in the thim-ekit/archive-course/get-courses REST endpoint, exploitable via post_status in the params_url payload.	CWE-862
post_status	query param	thim-ekit/archive-course/get-courses	Unauthorized access to private or draft LearnPress course content due to missing validation in the thim-ekit/archive-course/get-courses REST endpoint, exploitable via post_status in the params_url payload.	CWE-862

17 Jun 2026 10:16Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15.3

EPSS0.00262

SSVC

CWE-862