blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-87791

HIGH 8.7 CVSS 4.0
Published
September 15, 2026
Last modified
September 18, 2026
NVD status
Deferred
Reported by
a6d3dc9e-0591-4a13-bce7-0f5b31ff6158
Weakness
CWE-22
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Description

A path traversal vulnerability exists in the reserved_file_check function of the functions.php file in the WordPress Design Scuole Italia theme. The vulnerability allows an unauthenticated attacker to download arbitrary files accessible by the web server process.

Affected products and versions

  • Developers Italia design-scuole-wordpress-theme — From 2.6.0 (including) to 2.18.1 (including)

References

  • github.com https://github.com/italia/design-scuole-wordpress-theme
  • www.acn.gov.it https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-nel-tema-wordpress-design-scuole-italia-
  • nvd.nist.gov Official NVD record