CVE-2026-1870

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1870", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-03T23:11:32.158Z", "datePublished": "2026-03-14T13:24:42.173Z", "dateUpdated": "2026-04-08T17:02:42.813Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:42.813Z"}, "affected": [{"vendor": "thimpress", "product": "Thim Kit for Elementor \u2013 Pre-built Templates & Widgets for Elementor", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.3.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Thim Kit for Elementor \u2013 Pre-built Templates & Widgets for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing validation checks on the 'thim-ekit/archive-course/get-courses' REST endpoint callback function in all versions up to, and including, 1.3.7. This makes it possible for unauthenticated attackers to disclose private or draft LearnPress course content by supplying post_status in the params_url payload."}], "title": "Thim Kit for Elementor <= 1.3.7 - Missing Authorization to Unauthenticated Private Course Disclosure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7c82577a-e7ee-4549-8d0f-bed09effa035?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3467195/thim-elementor-kit"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Youssef Elouaer"}], "timeline": [{"time": "2026-02-04T03:25:32.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-14T00:34:04.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-17T15:06:15.709874Z", "id": "CVE-2026-1870", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-17T15:06:26.558Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1870", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-17T15:06:15.709874Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-17T15:06:20.522Z"}}], "cna": {"title": "Thim Kit for Elementor <= 1.3.7 - Missing Authorization to Unauthenticated Private Course Disclosure", "credits": [{"lang": "en", "type": "finder", "value": "Youssef Elouaer"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "thimpress", "product": "Thim Kit for Elementor \u2013 Pre-built Templates & Widgets for Elementor", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.3.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-04T03:25:32.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-14T00:34:04.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7c82577a-e7ee-4549-8d0f-bed09effa035?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3467195/thim-elementor-kit"}], "descriptions": [{"lang": "en", "value": "The Thim Kit for Elementor \u2013 Pre-built Templates & Widgets for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing validation checks on the 'thim-ekit/archive-course/get-courses' REST endpoint callback function in all versions up to, and including, 1.3.7. This makes it possible for unauthenticated attackers to disclose private or draft LearnPress course content by supplying post_status in the params_url payload."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:42.813Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1870", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:02:42.813Z", "dateReserved": "2026-02-03T23:11:32.158Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-14T13:24:42.173Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Thim Kit for Elementor \u2013 Pre-built Templates & Widgets for Elementor", "vendor": "thimpress", "versions": [{"lessThanOrEqual": "1.3.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Thim Kit for Elementor \u2013 Pre-built Templates & Widgets for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing validation checks on the 'thim-ekit/archive-course/get-courses' REST endpoint callback function in all versions up to, and including, 1.3.7. This makes it possible for unauthenticated attackers to disclose private or draft LearnPress course content by supplying post_status in the params_url payload."}, {"lang": "es", "value": "El plugin Thim Kit for Elementor \u2013 Pre-built Templates &amp; Widgets for Elementor para WordPress es vulnerable al acceso no autorizado de datos debido a la falta de comprobaciones de validaci\u00f3n en la funci\u00f3n de callback del endpoint REST 'thim-ekit/archive-course/get-courses' en todas las versiones hasta la 1.3.7, inclusive. Esto permite a atacantes no autenticados divulgar contenido de cursos privados o en borrador de LearnPress al proporcionar post_status en la carga \u00fatil params_url."}], "id": "CVE-2026-1870", "lastModified": "2026-06-17T10:16:38.447", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1870", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-17T15:06:15.709874Z", "version": "2.0.3"}}]}, "published": "2026-03-16T14:18:07.993", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3467195/thim-elementor-kit"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7c82577a-e7ee-4549-8d0f-bed09effa035?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.3.7]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Thim Kit for Elementor \u2013 Pre-built Templates & Widgets for Elementor", "source": "cna", "vendor": "thimpress"}, "product": "thim_kit_for_elementor_\u2013_pre-built_templates_&_widgets_for_elementor", "vendor": "thimpress"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-17T16:53:45.691790+00:00", "value": {"mitigation_remediation": ["Update the Thim Kit for Elementor plugin to the latest version (beyond 1.3.7).", "Verify that the 'thim-ekit/archive-course/get-courses' endpoint now requires proper authorization."], "summary": {"action": "Immediate Patch", "impact": "Private Data Exposure"}, "threat_synthesis": {"affected_systems": "The issue affects the thimpress Thim Kit for Elementor \u2013 Pre-built Templates & Widgets for Elementor product, specifically all releases up to and including version 1.3.7. No additional impacted versions were reported in the provided information.", "description_and_impact": "The vulnerability exists in the Thim Kit for Elementor plugin for WordPress, where the 'thim-ekit/archive-course/get-courses' REST endpoint lacks proper authorization checks. This oversight is classified as CWE-862 (Missing Authorization). An unauthenticated attacker can trigger the endpoint and supply a post_status parameter, causing the plugin to return private or draft LearnPress course content. Consequently, confidential learning materials and personal data stored within courses become exposed to anyone who can craft a request to the endpoint.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by sending crafted HTTP requests to the REST endpoint without needing authentication. If successful, they can retrieve private or draft course content, potentially compromising confidentiality and, if the content includes sensitive instructor or student data, could lead to broader privacy violations."}}}}, "created": "2026-03-16T09:22:22.365655+00:00", "updated": "2026-03-23T13:39:07.106603+00:00", "vendors": ["thimpress", "thimpress$PRODUCT$thim_kit_for_elementor_\u2013_pre-built_templates_&_widgets_for_elementor", "wordpress", "wordpress$PRODUCT$wordpress"]}