Ultimate Multisite vulnerabilities
We track 2 vulnerabilities in Ultimate Multisite products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 14, 2026.
2vulnerabilities
1critical
1high
0exploited
9.2average CVSS score
Latest Ultimate Multisite vulnerabilities
- 8.6 High severity
Ultimate Multisite: Improper Limitation of a Pathname to a Restricted Directory
The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and read arbitrary local files, including the WordPress configuration file.
- 9.8 Critical severity
Ultimate Multisite: Improper Authentication
The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes th