ThimPress Course Wishlist Plugin up to 4.1.1 render_button user_id information disclosure

Summaryinfo

A vulnerability categorized as problematic has been discovered in ThimPress Course Wishlist Plugin up to 4.1.1. Affected by this issue is the function render_button of the component Wishlist. Executing a manipulation of the argument user_id can lead to information disclosure. The identification of this vulnerability is CVE-2026-127213. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in ThimPress Course Wishlist Plugin up to 4.1.1. This vulnerability affects the function render_button of the component Wishlist. The manipulation of the argument user_id with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. CVE summarizes:

LearnPress Course Wishlist Add-on before 4.1.2 contains an insecure direct object reference vulnerability that allows remote attackers to manipulate any user's course wishlist by supplying an arbitrary user_id parameter to the render_button callback instead of relying on the session identity. Attackers can exploit the publicly accessible load_content_via_ajax REST route, which only requires a public wp_rest nonce, to add or remove courses from any user's wishlist and determine whether a given course is wishlisted by iterating user_id and course_id values.

The advisory is shared for download at wordpress.org. This vulnerability was named CVE-2026-127213 since 11/12/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading to version 4.1.2 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• ThimPress

Name

• Course Wishlist Plugin

Version

• 4.1.0
• 4.1.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion