CVE-2026-107508

8.6High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.6High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-22

Impact

Unauthenticated remote attackers can read arbitrary local files from the server, including wp-config.php and database credentials. They only need network access to the WordPress site to trigger the file inclusion.

Root cause

The plugin does not validate user-supplied input before passing it to a file inclusion function.

Affected systems

Ultimate Multisite WordPress plugin versions before 2.17.2

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Fix & remediation

Upgrade the Ultimate Multisite plugin to version 2.17.2 or later. If updating immediately is not possible, deactivate and disable the plugin.

shell

$ wp plugin update ultimate-multisite --version=2.17.2

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and read arbitrary local files, including the WordPress configuration file.

References

https://wpscan.com/vulnerability/2b2808d3-b3fc-41d4-8be5-82d222911bc6/

Source: nvd.nist.gov/vuln/detail/CVE-2026-107508