CVE-2026-87791

The Design Scuole Italia WordPress theme contains an unauthenticated path traversal flaw (CWE-22) in the reserved_file_check function of functions.php, rated 8.7 (high) under CVSS 4.0. A remote attacker with no credentials can send a crafted request with traversal sequences to a file-download endpoint handled by the theme, tricking it into serving files outside the intended directory. Successful exploitation discloses arbitrary files readable by the web server process, most critically wp-config.php, which contains database credentials, salts, and keys. Affected parties are WordPress sites — primarily Italian school websites — running an unpatched version of the theme; the advisory data does not specify an exact affected version range. No public proof of concept is known, the flaw is not in CISA's KEV catalog, and no exploitation has been observed.

What to do: Update the Design Scuole Italia theme to the latest release from the official repository and confirm the reserved_file_check function in functions.php is patched. Inspect access logs for unauthenticated file-download requests containing dot-dot path traversal patterns or successful retrieval of sensitive files such as wp-config.php, /etc/passwd, or environment files. As defense-in-depth, block traversal sequences in download parameters via WAF rules, and rotate database credentials and authentication salts if any suspicious file access is found.