Description (CNA)
The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsi_pdf_generator and dsi_csv_generator functions, allowing an unauthenticated attacker to access restricted "Circolare" content and registered users' data. An unauthenticated RSS feed at /circolare/feed/ further facilitates exploitation.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Developers Italia / design-scuole-wordpress-theme | affected 1.0 through 2.17.3 |
CWE
CWE-862, CWE-200
References
- https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-nel-tema-wordpress-design-scuole-italia-
- https://github.com/italia/design-scuole-wordpress-theme
ADP enrichment
No English description supplied.
No references supplied.