CVE-2026-87791CWE-22path-traversal

CVE-2026-87791

published September 15, 2026

CVSS
8.7
EPSS
1%
Percentile
44.5
In the wild
Unconfirmed
What it is

A path traversal vulnerability exists in the reserved_file_check function of the functions.php file in the WordPress Design Scuole Italia theme. The vulnerability allows an unauthenticated attacker to download arbitrary files accessible by the web server process.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00538 · 44.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-09-15T20:17Z
References (2)
https://github.com/italia/design-scuole-wordpress-theme · a6d3dc9e-0591-4a13-bce7-0f5b31ff6158https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-nel-tema-wordpress-design-scuole-italia- · a6d3dc9e-0591-4a13-bce7-0f5b31ff6158
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 15 SEP 15:10Z
    Path traversal vulnerability in WordPress theme design-scuole-wordpress-theme
    cvelistv5