CVE-2026-87792 describes multiple authorization bypass vulnerabilities (CWE-862) in the Design Scuole Italia WordPress theme, specifically in the dsi_pdf_generator and dsi_csv_generator functions. These vulnerabilities enable unauthenticated attackers to access restricted Circolare content and data of registered users. An unauthenticated RSS feed endpoint (/circolare/feed/) further aids in exploiting these flaws. The affected versions are >=1.0 and <=2.17.3. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, with high impact on confidentiality.

Successful exploitation allows unauthenticated attackers to bypass authorization controls and access sensitive restricted content and user data within the WordPress theme. This compromises confidentiality of Circolare content and registered users' information. The high CVSS score (8.7) reflects the significant confidentiality impact and ease of exploitation without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently provided. Until a patch is available, restrict access to the affected endpoints and consider disabling the vulnerable functions or RSS feed if possible to reduce exposure.