← CVE Intelligence

CVE-2026-107508

Ultimate Multisite < 2.17.2 - Unauthenticated LFI via 'attributes' Parameter PUBLISHED

Description (CNA)

The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and read arbitrary local files, including the WordPress configuration file.

Affected (CNA)

Vendor / productVersions
Unknown / Ultimate Multisiteaffected 0 before 2.17.2

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.