CVE-2026-87792: Multiple authorization bypass in WordPress theme design-scuole-wordpress-theme
The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsipdfgenerator and dsicsvgenerator functions, allowing an unauthenticated attacker to access restricted "Circolare" content and registered users' data. An unauthenticated RSS feed at /circolare/feed/ further facilitates exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
WordPress theme design-scuole-wordpress-theme (Design Scuole Italia)from your environment.Uninstall the affected Design Scuole Italia WordPress theme if you do not need it, to eliminate the authorization bypass paths in dsi_pdf_generator and dsi_csv_generator.
- Compensating control
Restrict public access to the unauthenticated RSS feed endpoint /circolare/feed/ (e.g., via web server access controls, WAF rules, or authentication) to prevent unauthenticated attackers from facilitating exploitation.
Event History
Frequently Asked Questions
Who can exploit these authorization bypasses?
An unauthenticated attacker can exploit the affected PDF and CSV generator functions to access restricted Circolare content and data belonging to registered users. No authenticated WordPress account is required.
Is there an exposed endpoint that may make exploitation easier?
Yes. The /circolare/feed/ RSS feed is unauthenticated and is identified as facilitating exploitation.
What information may be exposed?
The issue can expose restricted "Circolare" content and registered users' data through the affected dsi_pdf_generator and dsi_csv_generator functions.