CVE-2026-87792 in Design Scuole Italia Plugin
Summary
by MITRE • 09/15/2026
The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsi_pdf_generator and dsi_csv_generator functions, allowing an unauthenticated attacker to access restricted "Circolare" content and registered users' data. An unauthenticated RSS feed at /circolare/feed/ further facilitates exploitation.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The Design Scuole Italia WordPress theme contains critical security flaws rooted in insufficient authorization checks within its core functionality modules, specifically affecting the dsi_pdf_generator and dsi_csv_generator functions. These vulnerabilities represent a classic case of broken access control where the application fails to properly verify that an incoming request originates from an authenticated user with appropriate privileges before processing sensitive data operations. The architectural design flaw allows any entity interacting with these endpoints, regardless of authentication status or role assignment, to trigger generation processes intended for administrative or registered users only. This lack of server-side validation creates a direct pathway for unauthorized entities to bypass the application's security perimeter and access resources that should remain confidential.
The operational impact of this authorization bypass is severe, as it enables unauthenticated attackers to extract restricted content categorized under Circolare, which typically includes internal school communications, administrative directives, or sensitive institutional data not meant for public dissemination. Furthermore, the vulnerability extends beyond document generation to include the exposure of registered users' personal and professional data stored within the WordPress database structure associated with these functions. By exploiting this flaw, an attacker can programmatically request PDF or CSV exports containing private information such as student records, staff details, contact lists, or internal correspondence. This capability transforms a simple theme defect into a significant data breach vector capable of compromising privacy regulations and institutional integrity.
Compounding the severity of these direct exploitation vectors is the presence of an unauthenticated RSS feed located at /circolare/feed/. While RSS feeds are commonly used for content syndication, in this context, they serve as an additional attack surface that facilitates automated harvesting of restricted information without requiring any form of authentication or interaction with the vulnerable generator functions. This feed likely mirrors the data accessible through the bypassed endpoints, providing attackers with a standardized XML format to parse and extract large volumes of sensitive Circolare content efficiently. The combination of direct API-level exploitation via PDF/CSV generators and passive harvesting via RSS creates a comprehensive exposure model where both real-time extraction and bulk data collection are feasible for any internet user.
From a classification perspective, these vulnerabilities align with CWE-285 Improper Authorization, as the system fails to enforce proper access controls on critical functions. The exploitation technique also maps to MITRE ATT&CK techniques related to Collection via Unsecured API or Data from Information Repositories, specifically T1074 and associated sub-techniques involving web scraping of exposed endpoints. To mitigate these risks, immediate remediation is required by implementing strict role-based access control checks within the dsi_pdf_generator and dsi_csv_generator functions to ensure only authenticated users with specific capabilities can invoke them. Additionally, the unauthenticated RSS feed at /circolare/feed/ should be restricted to authorized audiences or disabled entirely if public syndication is not a business requirement. Developers must also audit all other endpoints for similar authorization gaps and implement comprehensive logging to detect any ongoing exploitation attempts while updating the theme to include these security patches in future releases.