CVE-2026-87792: Design Scuole Italia Auth Bypass Vulnerability

CVE-2026-87792 Overview

CVE-2026-87792 affects the "Design Scuole Italia" WordPress theme used by Italian school websites. The vulnerability consists of multiple authorization bypass flaws in the dsi_pdf_generator and dsi_csv_generator functions. Unauthenticated attackers can access restricted Circolare (school circular) content and registered user data. An unauthenticated RSS feed exposed at /circolare/feed/ further facilitates exploitation by enumerating protected resources. The issue is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can retrieve restricted school communications and personally identifiable information belonging to registered users of affected school portals.

Affected Products

Design Scuole Italia WordPress theme (design-scuole-wordpress-theme)
WordPress instances deploying the theme for Italian public school portals
Sites exposing the /circolare/feed/ endpoint publicly

Discovery Timeline

2026-09-15 - CVE-2026-87792 published to the National Vulnerability Database
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-87792

Vulnerability Analysis

The theme provides two generator endpoints, dsi_pdf_generator and dsi_csv_generator, intended to export circular documents and user datasets. Both endpoints fail to enforce authentication and capability checks before returning data. An attacker can invoke these functions directly over HTTP without a valid session. The response includes restricted Circolare content and registered user records that should remain gated behind login controls. The theme also exposes an RSS feed at /circolare/feed/ that lists protected circulars, allowing an attacker to enumerate identifiers used by the generator endpoints. Together these flaws enable full extraction of restricted communications and user data in an automated fashion.

Root Cause

The root cause is missing authorization enforcement in the PDF and CSV export handlers. The functions do not call current_user_can() or validate a nonce before processing requests. Access is granted based on request parameters alone, treating any HTTP caller as authorized. The public RSS feed compounds the issue by advertising resource identifiers required for exploitation.

Attack Vector

The vulnerability is exploitable over the network with no privileges and no user interaction. An attacker retrieves the list of protected circulars from /circolare/feed/, then issues direct HTTP requests to the dsi_pdf_generator and dsi_csv_generator handlers to download restricted content and user records. See the GitHub Design Theme Repository and the ACN Vulnerabilities Report for the Theme for technical context.

Detection Methods for CVE-2026-87792

Indicators of Compromise

Unauthenticated HTTP GET requests to URLs containing dsi_pdf_generator or dsi_csv_generator
Repeated access to /circolare/feed/ from a single client followed by generator endpoint calls
Anomalous outbound CSV or PDF response sizes from the WordPress instance to external IPs
User-Agent strings associated with scraping tools accessing generator endpoints

Detection Strategies

Review web server access logs for requests to the two generator functions without an authenticated session cookie
Correlate /circolare/feed/ enumeration with subsequent bulk downloads from the same source IP
Alert on CSV responses containing user email addresses or personal data leaving the WordPress host

Monitoring Recommendations

Ingest WordPress and reverse proxy logs into a centralized SIEM for behavioral baselining of the theme endpoints
Enable rate-limit alerts on the /circolare/feed/ and generator paths
Monitor WordPress theme file integrity to detect unauthorized modifications to the vulnerable handlers

How to Mitigate CVE-2026-87792

Immediate Actions Required

Restrict access to the dsi_pdf_generator and dsi_csv_generator endpoints at the web server or WAF layer until a fixed theme version is available
Block or authenticate access to /circolare/feed/ to prevent enumeration of protected circulars
Audit web access logs for prior exploitation attempts against the affected endpoints
Notify users whose data may have been exposed, in line with GDPR obligations for Italian public sector operators

Patch Information

Monitor the GitHub Design Theme Repository for an official update that adds capability checks and nonce validation to the generator functions. Follow guidance published by the Italian National Cybersecurity Agency in the ACN Vulnerabilities Report for the Theme.

Workarounds

Deploy a WordPress-aware WAF rule denying unauthenticated requests to the vulnerable handlers
Add web server rewrite rules that require an authenticated session cookie before proxying requests to dsi_pdf_generator and dsi_csv_generator
Temporarily disable the affected theme features by removing or overriding the vulnerable functions in a child theme
Place the site behind an authentication proxy for administrative and export endpoints

bash

# Example nginx snippet to block unauthenticated access to the vulnerable endpoints
location ~* /(dsi_pdf_generator|dsi_csv_generator) {
    if ($http_cookie !~* "wordpress_logged_in_") {
        return 403;
    }
}

location = /circolare/feed/ {
    return 403;
}