What is the CVSS score of CVE-2026-1870?

CVE-2026-1870 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-1870?

Organizations using Widgets for Elementor should be aware of moderate risk from CVE-2026-1870, a missing authorization vulnerability rated CVSS 5.3.

How to fix or mitigate CVE-2026-1870?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-1870

EUVD-2026-12184 MEDIUM

Missing Authorization (CWE-862)

2026-03-14 Wordfence

WordPress Authentication Bypass Elementor

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 14:00 euvd

EUVD-2026-12184

Analysis Generated

Mar 14, 2026 - 14:00 vuln.today

CVE Published

Mar 14, 2026 - 13:24 nvd

MEDIUM 5.3

DescriptionCVE.org

The Thim Kit for Elementor - Pre-built Templates & Widgets for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing validation checks on the 'thim-ekit/archive-course/get-courses' REST endpoint callback function in all versions up to, and including, 1.3.7. This makes it possible for unauthenticated attackers to disclose private or draft LearnPress course content by supplying post_status in the params_url payload.

AnalysisAI

The Thim Kit for Elementor plugin for WordPress versions up to 1.3.7 allows unauthenticated attackers to access private and draft LearnPress course content through an improperly secured REST API endpoint that accepts arbitrary post status parameters. The vulnerability stems from missing input validation on the 'thim-ekit/archive-course/get-courses' endpoint, enabling information disclosure to any remote attacker without authentication or user interaction. No patch is currently available for this medium-severity flaw affecting WordPress installations using the vulnerable plugin.

Technical ContextAI

The vulnerability exists in the 'thim-ekit/archive-course/get-courses' REST endpoint callback function within the Thim Kit for Elementor WordPress plugin (CPE prefix: cpe:2.3:a:thimpress:thim_kit_for_elementor). The root cause is classified under CWE-862 (Missing Authorization), indicating the endpoint fails to validate user capabilities before processing requests. WordPress REST endpoints typically use the register_rest_route() function with permission_callback parameter; this endpoint either omits the permission_callback entirely or implements insufficient checks. By supplying arbitrary post_status values in URL parameters, attackers bypass WordPress's built-in post visibility checks that normally restrict draft and private content to authorized users. The plugin integrates with LearnPress LMS and exposes course data through an unauthenticated REST interface without proper access control.

RemediationAI

Upgrade Thim Kit for Elementor to version 1.3.8 or later immediately through the WordPress plugin dashboard or direct download from the vendor. This patch version should include authentication and authorization validation on the 'thim-ekit/archive-course/get-courses' REST endpoint. Until patching is feasible, implement workarounds by disabling REST API access to the vulnerable endpoint via Web Application Firewall (WAF) rules blocking requests to /wp-json/thim-ekit/archive-course/get-courses with status parameters, or restrict REST API access to authenticated users only via WordPress configuration (disable_rest_api option or custom authentication middleware). Additionally, review course visibility settings in LearnPress to ensure sensitive courses are not inadvertently set to statuses queryable by unauthenticated users. Monitor access logs for suspicious REST endpoint queries and consider implementing IP-based restrictions on the WordPress install until patched.