Unknown Ultimate Multisite vulnerabilities

2 vulnerabilities

Known vulnerabilities in Unknown Ultimate Multisite, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8.6CVE-2026-107508unknownultimate multisite
EPSS score
0.50%
The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and read arbitrary local files, including the WordPress configuration file.9.8CVE-2026-103646unknownultimate multisite+1
EPSS score
0.44%
The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes that address differently from the lookup used to create the customer, so an unauthenticated attacker can log in as any existing user, including a Network Super Admin, whose email address they know. This bypass is not addressed by the 2.15.1 fix for CVE-2026-75957 and remains exploitable in all versions up to and including 2.16.1, the releases that fix was expected to cover. Exploitation requires a checkout form configured without a password field (auto-generated password) and a target account that has no existing customer record in the Ultimate Multisite WordPress plugin before 2.17.0.