Executive brief
The Design Scuole Italia WordPress theme is used to build official school websites across Italy. A path traversal vulnerability in its file-download function allows attackers to bypass security checks and download sensitive files from the web server, including configuration files and potentially user data.
Technical details
A path traversal vulnerability exists in the reserved_file_check function within functions.php of the Design Scuole Italia WordPress theme. The vulnerability is caused by inadequate validation of file paths passed through the download request. An unauthenticated attacker can craft a malicious request with path traversal sequences (e.g., "../") to manipulate the file path parameter and download arbitrary files accessible by the web server process. No authentication is required to exploit this vulnerability; a network request to the vulnerable endpoint is sufficient. The attacker can read sensitive files such as configuration files, private keys, or other data accessible by the web process.
Affected products
- Italia Design Scuole Italia WordPress Theme before 2.18.3
Timeline
- 2026-09-15: disclosed
- 2026-09-15: advisory: CSIRT Italy advisory AL02/260915/CSIRT-ITA