CVE-2026-107508: Ultimate Multisite < 2.17.2 - Unauthenticated LFI via 'attributes' Parameter
The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and read arbitrary local files, including the WordPress configuration file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ultimate Multisite WordPress pluginto a version that resolves this vulnerability.Fixed in 2.17.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker does not need to authenticate. Any deployment running a vulnerable Ultimate Multisite version before 2.17.2 is potentially exposed.
What could an attacker access?
The flaw can allow inclusion and reading of arbitrary local files. This includes the WordPress configuration file, which may contain sensitive configuration details.
What should be updated?
Update Ultimate Multisite to version 2.17.2 or later. Versions before 2.17.2 are affected.