The Ultimate Multisite WordPress plugin contains an unauthenticated local file inclusion flaw that arises when an attacker supplies an unvalidated 'attributes' parameter. This flaw permits the inclusion and reading of arbitrary local files on the server, including the WordPress configuration file. The impact is the unintended disclosure of sensitive data such as database credentials, user information, and potentially full server compromise if an attacker can read additional files. This vulnerability is an input validation weakness that can lead to information exposure.

The vulnerability affects the Ultimate Multisite WordPress plugin for all installations with a version earlier than 2.17.2. Any WordPress site using this plugin prior to that release is at risk, as the plugin is distributed through the WordPress plugin repository and used by many sites that have installed it.

The flaw allows unauthenticated attackers to read arbitrary local files via a malicious HTTP request that includes a crafted 'attributes' parameter. The CVSS score is 8.6, indicating a high severity risk. The EPSS score is < 1%, indicating a low probability of being actively exploited, and the vulnerability is not included in the CISA KEV catalog. Nonetheless, because the flaw provides access to the wp-config.php file, an attacker can obtain database credentials and potentially gain further control, so the impact remains high. The attacker only needs to make a request that targets the plugin's endpoint; no authentication or other privilege is required.