Skip to content
Sign in
8.6 High

CVE-2026-107508 The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file…

Description

The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and read arbitrary local files, including the WordPress configuration file.

Affected products and versions

Product Affected versions Fixed in
Ultimate Multisite 2.17 earliest → < 2.17.2 2.17.2

Other CVEs of Ultimate Multisite

The 2 CVEs of Ultimate Multisite →
CVE-2026-103646 The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is… 9.8 Critical
Track this CVE