CVE-2026-107508
Ultimate Multisite < 2.17.2 - Unauthenticated LFI via 'attributes' Parameter
Unknown Ultimate Multisite
CVSS
8.6HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.50%Chance of exploitation activity in the next 30 days, higher than 42% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2.17.2Ultimate MultisiteCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and read arbitrary local files, including the WordPress configuration file.
Text from CVE List
Affected versions 1
- Ultimate Multisiteaffected: all versions before 2.17.2CVE List