{"id":"CVE-2026-109219","published":"2026-10-16T05:17:29.100","lastModified":"2026-10-16T15:17:06.810","description":"The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.4 via the mbw_file_upload function. This is due to missing file extension validation on the attacker-supplied image_path parameter, whose basename-derived file name bypasses the extension allowlist applied only to the separate file_name parameter. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the board to be configured to allow guest posts, which is the plugin's default mode; the required nonce is printed on every public board page, making it readable by any unauthenticated visitor without a WordPress login.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-434"],"vendors":[],"products":[],"references":[{"url":"https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/api/mb-board.php#L428","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L902","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L903","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L972","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/mb-actions.php#L520","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset/3743247/mangboard/trunk/includes/functions/func.api.php","tags":[]},{"url":"https://wordpress.org/plugins/mangboard/","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1e4f4860-b4c9-4f41-b1d0-0b2da8c88b99?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Mang Board plugin allows unauthenticated attackers to upload arbitrary files, including executable ones, due to insufficient validation of the image_path parameter. This vulnerability can lead to remote code execution on affected WordPress sites.","exploitability":"Exploitation is straightforward for unauthenticated attackers who can access public board pages, as the required nonce is publicly exposed and guest posting is enabled by default.","blast_radius":"The vulnerability affects all WordPress installations using Mang Board plugin versions up to 2.4.4, with widespread impact since guest posting is enabled by default and no authentication is required for exploitation.","remediation":"Upgrade to version 2.4.5 or later to remediate this vulnerability.","detection":"Monitor for unusual file uploads in the wp-content/uploads directory, particularly executable files (.php, .jsp, .asp) with names derived from image_path parameters, and check web server logs for requests to the mbw_file_upload endpoint with suspicious file extensions.","tags":["rce","file-upload","wordpress","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-16T08:46:58.335Z"}}