The Thim Kit for Elementor plugin contains a missing authorization vulnerability (CWE-862) in its REST API endpoint 'thim-ekit/archive-course/get-courses'. This endpoint fails to validate whether the requester is authorized to access certain LearnPress course content, specifically private or draft courses. By manipulating the post_status parameter in the API request, an unauthenticated attacker can retrieve restricted course data. This vulnerability affects all versions up to 1.3.7 and has a CVSS 3.1 base score of 5.3, indicating a medium severity impact focused on confidentiality loss without integrity or availability impact.

An unauthenticated attacker can disclose private or draft LearnPress course content that should normally be restricted. This results in a confidentiality breach of potentially sensitive course information. There is no impact on data integrity or availability reported. No known exploits in the wild have been documented at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the vulnerable REST endpoint via web application firewall rules or other access controls to prevent unauthenticated requests. Monitor vendor channels for updates and apply any official patches promptly once available.