Security Alert Summary
The Design Scuole Italia WordPress theme contains authorization bypass vulnerabilities in the dsi_pdf_generator and dsi_csv_generator functions. An unauthenticated attacker can access restricted “Circolare” content and registered users’ data. An unauthenticated RSS feed at /circolare/feed/ is also noted as facilitating exploitation.
CVE Details
- CVE ID: CVE-2026-87792
- Affected component: Design Scuole Italia WordPress theme
- Affected versions: Versions 1.0 through 2.17.3 (all versions less than or equal to 2.17.3)
- Published: September 15, 2026 at 4:17:37 PM UTC
- Last modified: September 15, 2026 at 4:17:37 PM UTC
- CVSS (v4.0): Base score 8.7 (High); vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Authentication / Privileges / User interaction: Authentication required: none; Privileges required: none; User interaction: none
- Primary impact: Confidentiality: High; Integrity: None; Availability: None
- CWE / weakness ID: CWE-200, CWE-862
Technical Details
The issue consists of multiple authorization bypass vulnerabilities reported in the theme’s dsi_pdf_generator and dsi_csv_generator functions. According to the description, these flaws allow an unauthenticated attacker to retrieve restricted “Circolare” content and data belonging to registered users. The presence of an unauthenticated RSS feed at /circolare/feed/ is identified as a facilitating factor for exploitation.
The named functions and feed endpoint indicate the vulnerability stems from missing or insufficient access control checks in those code paths, allowing access without appropriate authorization checks. The impact is disclosure of restricted content and user data rather than direct modification or denial of service, based on the CVSS confidentiality/integrity/availability impacts provided.
How This Could Impact Your Website
On a typical site using this theme, the site owner publishes Circolare posts intended for a restricted internal audience. Internal staff or contributors may rely on role-based access to keep certain notices private. An external contractor or an unauthenticated visitor could leverage the affected endpoints and the public RSS feed to access those restricted posts and data about registered users, such as email addresses.
Practical consequences include exposure of internal user email addresses and an increased risk of targeted phishing or social engineering against staff. The issue, as described, is one of information disclosure rather than content modification or full site takeover.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected theme as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained themes and plugins.
- Monitor site activity and access logs for unusual behavior related to feed and export endpoints.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
