This vulnerability (CWE-22) exists in the reserved_file_check function within the functions.php file of the Design Scuole Italia WordPress theme. It enables unauthenticated remote attackers to perform path traversal attacks, thereby downloading arbitrary files that the web server process can access. The affected versions are >=2.6.0 and <=2.18.1. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

An unauthenticated attacker can exploit this vulnerability to download arbitrary files from the server that the web server process has access to. This can lead to unauthorized disclosure of sensitive information stored on the server. The vulnerability does not require user interaction or privileges, increasing its risk. The CVSS score of 8.7 reflects a high impact due to the ease of exploitation and potential confidentiality breach.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, consider restricting access to sensitive files via web server configuration and monitoring for suspicious file access patterns related to path traversal attempts.