Ultimate Multisite CVE-2026-107508

No special conditions beyond having the Ultimate Multisite plugin (version earlier than 2.17.2) installed and active on an internet-reachable WordPress site. Exploitation targets the plugin's file-selection feature, which accepts a user-supplied value naming the file to include without validation, enabling path traversal to arbitrary local files such as wp-config.php. The CVSS vector (PR:N/UI:N) confirms no authentication and no user interaction are required, so there is no meaningful limiting factor other than the plugin being present and the specific vulnerable code path being reachable; the primary limiter is simply the plugin's relatively narrow deployment.

This is a genuinely high-priority, internet-facing vulnerability rather than a paper-tiger high CVSS. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6) describes network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction - the easiest possible access profile. These signals are internally consistent with the description, which states unauthenticated attackers can include and read arbitrary local files including wp-config.php (confidentiality-only impact, hence C:H/I:N/A:N). Publicly available exploit code exists (WPScan), which meaningfully lowers the skill barrier. The SSVC framework aligns: Automatable=yes (attackers can script mass scanning/exploitation of WordPress sites) with partial technical impact (read-only file disclosure). The one tempering signal is EPSS: only 0.20% (10th percentile), and SSVC Exploitation=none, indicating no confirmed active exploitation yet despite POC availability. This reflects the lag between POC publication and observed mass exploitation rather than low exploitability - do not conflate low EPSS with low risk here, because the combination of unauthenticated access, public POC, and Automatable=yes makes opportunistic exploitation likely. No conflicting data between vector and description was identified.

An unauthenticated attacker sends a crafted HTTP request to a vulnerable site, supplying a traversal path (e.g., ../../wp-config.php) to the plugin's unvalidated file-inclusion parameter. Because public exploit code exists and no authentication or user interaction is required, the attacker retrieves wp-config.php and harvests database credentials and secret keys, enabling follow-on database access or further compromise.