CVE-2026-1870: Thim Kit Elementor Information Disclosure

CVE-2026-1870 Overview

The Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor plugin for WordPress contains a missing authorization vulnerability that allows unauthorized access to sensitive data. The vulnerability exists due to missing validation checks on the thim-ekit/archive-course/get-courses REST endpoint callback function in all versions up to and including 1.3.7. This flaw enables unauthenticated attackers to disclose private or draft LearnPress course content by manipulating the post_status parameter in the params_url payload.

Critical Impact

Unauthenticated attackers can access private and draft LearnPress course content without any authentication, potentially exposing unreleased educational material, proprietary course content, and confidential business information.

Affected Products

• Thim Kit for Elementor plugin for WordPress versions up to and including 1.3.7
• WordPress installations using Thim Kit for Elementor with LearnPress integration
• LearnPress course content accessible via the vulnerable REST endpoint

Discovery Timeline

• 2026-03-16 - CVE CVE-2026-1870 published to NVD
• 2026-03-16 - Last updated in NVD database

Technical Details for CVE-2026-1870

Vulnerability Analysis

This vulnerability is classified under CWE-862 (Missing Authorization), indicating a fundamental flaw in access control implementation. The REST API endpoint thim-ekit/archive-course/get-courses lacks proper permission validation, allowing any user—including unauthenticated visitors—to query course data that should be restricted.

The vulnerability is particularly concerning because it exposes content management states that WordPress typically protects. Draft and private posts are intended to be visible only to authenticated users with appropriate capabilities, but this endpoint bypasses those protections entirely.

The attack requires no special privileges and can be executed remotely over the network without any user interaction. The primary impact is confidentiality breach, as attackers can extract sensitive course content that was never intended for public consumption.

Root Cause

The root cause of this vulnerability is the absence of authorization checks in the REST endpoint callback function. When the thim-ekit/archive-course/get-courses endpoint is called, it processes the params_url payload without verifying whether the requesting user has permission to view posts with the specified post_status. This allows arbitrary post status values like draft, private, or pending to be passed, returning content that should be access-controlled.

Attack Vector

The attack leverages the WordPress REST API to send crafted requests to the vulnerable endpoint. An attacker can construct a request that includes a post_status parameter set to draft or private within the params_url payload. The server processes this request without authentication checks and returns LearnPress course data matching the requested status.

This is a network-based attack that requires no authentication, no user interaction, and has low complexity. An attacker simply needs to identify WordPress sites running vulnerable versions of the Thim Kit for Elementor plugin and send appropriately crafted HTTP requests to extract protected course content.

The exploitation involves sending REST API requests with manipulated post_status values to the thim-ekit/archive-course/get-courses endpoint. Since no authentication is required, attackers can enumerate and extract all draft and private LearnPress course content. For detailed technical analysis, refer to the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-1870

Indicators of Compromise

• Unusual REST API requests to /wp-json/thim-ekit/archive-course/get-courses from external IP addresses
• Requests containing post_status=draft or post_status=private parameters in the payload
• Multiple sequential requests to the endpoint from the same IP attempting different status values
• Access logs showing unauthenticated requests retrieving course data with sensitive post statuses

Detection Strategies

• Monitor WordPress REST API access logs for requests to the thim-ekit/archive-course/get-courses endpoint
• Implement Web Application Firewall (WAF) rules to detect and block requests with suspicious post_status parameter values
• Deploy intrusion detection signatures for REST API abuse patterns targeting WordPress plugin endpoints
• Enable verbose logging for REST API endpoints to capture full request payloads for forensic analysis

Monitoring Recommendations

• Configure real-time alerting for REST API requests from unauthenticated users accessing course-related endpoints
• Establish baseline metrics for legitimate API usage and alert on anomalies in request volume or patterns
• Review access logs regularly for evidence of content enumeration attempts
• Implement rate limiting on REST API endpoints to slow potential automated exploitation

How to Mitigate CVE-2026-1870

Immediate Actions Required

• Update Thim Kit for Elementor plugin to a version newer than 1.3.7 immediately
• Review WordPress access logs for signs of prior exploitation attempts
• Audit any private or draft LearnPress course content that may have been exposed
• Consider temporarily disabling the plugin if an update is not immediately available

Patch Information

A security patch addressing this vulnerability has been released. The fix can be reviewed in the WordPress Plugin Changeset. Site administrators should update to the latest version of Thim Kit for Elementor through the WordPress plugin update mechanism or by downloading the patched version directly from the WordPress plugin repository.

Workarounds

• Restrict access to WordPress REST API endpoints using web server configuration or security plugins
• Implement authentication requirements for all REST API requests at the web server level
• Use a Web Application Firewall to block requests containing post_status parameters in REST API calls
• Consider disabling the vulnerable REST endpoint via custom code if the functionality is not needed

# Example .htaccess rules to restrict REST API access to the vulnerable endpoint
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-json/thim-ekit/archive-course/get-courses [NC]
RewriteCond %{HTTP_COOKIE} !wordpress_logged_in
RewriteRule .* - [F,L]
</IfModule>