Ultimate Multisite
Monthly
Unauthenticated local file inclusion in the Ultimate Multisite WordPress plugin before 2.17.2 allows remote attackers to traverse the filesystem and read arbitrary local files, including wp-config.php with its database credentials and authentication salts. The plugin passes a user-supplied file-selection value directly into an include operation without validation, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) confirms no authentication and no user interaction are required. Publicly available exploit code exists, but EPSS is low at 0.20% (10th percentile) and CISA SSVC records no known exploitation, so real-world risk is concentrated in internet-reachable WordPress sites that have the plugin active.
Unauthenticated local file inclusion in the Ultimate Multisite WordPress plugin before 2.17.2 allows remote attackers to traverse the filesystem and read arbitrary local files, including wp-config.php with its database credentials and authentication salts. The plugin passes a user-supplied file-selection value directly into an include operation without validation, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) confirms no authentication and no user interaction are required. Publicly available exploit code exists, but EPSS is low at 0.20% (10th percentile) and CISA SSVC records no known exploitation, so real-world risk is concentrated in internet-reachable WordPress sites that have the plugin active.