CVE-2026-87792

The Design Scuole Italia WordPress theme, a theme purpose-built for Italian school websites, contains multiple missing-authorization flaws (CWE-862) in its dsi_pdf_generator and dsi_csv_generator functions, resulting in sensitive-information exposure (CWE-200). An unauthenticated remote attacker can invoke these PDF/CSV export functions directly to retrieve restricted 'Circolare' (school circular/notice) content and data belonging to registered users without any credentials. Exploitation is further eased by an unauthenticated RSS feed at /circolare/feed/, which makes restricted circular content trivially harvestable in bulk. The issue is rated CVSS 4.0 8.7 (high) because it is network-exploitable with no privileges, no user interaction, and high confidentiality impact. No public proof of concept is known, the flaw is not in CISA's KEV catalog, and no exploitation in the wild has been reported.

What to do: Update the Design Scuole Italia theme to the latest available release as soon as a patched version is published, and verify with the maintainers which version fixes the dsi_pdf_generator/dsi_csv_generator flaws. Until then, block or require authentication for requests hitting the PDF/CSV generator endpoints and the /circolare/feed/ RSS feed (e.g., via a security plugin or web-server rules), and review access logs for unauthenticated access to these paths. Also audit whether restricted Circolare content or registered-user data has already been exported, and consider rotating user data if leaks are confirmed.