high8.6
CVE-2026-107508
The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attack…
Impact
The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and read arbitrary local files, including the WordPress configuration file.
Affected products
| Product | Affected versions |
|---|---|
| Ultimate Multisite WordPress Plugin | before 2.17.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.