CVE-2026-107508

UNKNOWN 0.0

Ultimate Multisite < 2.17.2 - Unauthenticated LFI via 'attributes' Parameter

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and read arbitrary local files, including the WordPress configuration file.

Vendor	unknown
Product	ultimate multisite
Published	Oct 14, 2026

Stay Ahead of the Next One

Get instant alerts for unknown ultimate multisite

Be the first to know when new unknown vulnerabilities affecting unknown ultimate multisite are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / Ultimate Multisite

0 < 2.17.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/2b2808d3-b3fc-41d4-8be5-82d222911bc6/

Credits

hanzzly (Farhan Auliya Abrar) WPScan