Thim Kit for Elementor Missing Authorization Vulnerability Allowing Unauthenticated Access to Private Course Data

A vulnerability exists in the Thim Kit for Elementor WordPress plugin, specifically in versions through 1.3.7. The issue arises from inadequate validation on the 'thim-ekit/archive-course/get-courses' REST endpoint, enabling unauthenticated attackers to access and disclose private or draft LearnPress course content by manipulating the post_status parameter. This unauthorized data access could lead to the exposure of sensitive course information.

Impact

Exploitation of this vulnerability allows for unauthorized disclosure of private or draft LearnPress course content.

Remediation

Users are advised to update the Thim Kit for Elementor plugin to version 1.3.8 or later.