{"id":"CVE-2026-111834","published":"2026-10-21T15:17:15.387","lastModified":"2026-10-21T18:19:16.950","description":"Unrestricted Upload of File with Dangerous Type vulnerability in Kitae Park Mang Board WP mangboard allows Upload a Web Shell to a Web Server.This issue affects Mang Board WP: from n/a through 2.4.4.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-434"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/mangboard/vulnerability/wordpress-mang-board-wp-plugin-2-4-4-arbitrary-file-upload-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Mang Board WP plugin (versions through 2.4.4) allows authenticated users with low privileges to upload files of any type, including dangerous web shell scripts, due to missing file type restrictions.","exploitability":"Exploitation requires valid low-privilege credentials and no user interaction; the vulnerability is straightforward to exploit once access is obtained.","blast_radius":"Successful exploitation enables remote code execution on the web server, leading to full compromise of confidentiality, integrity, and availability of the affected system.","remediation":"Upgrade to Mang Board WP version 2.4.5 or later, which includes a fix for this unrestricted file upload issue.","detection":"Look for unexpected PHP, ASPX, or other executable web shell files uploaded to publicly accessible directories (e.g., wp-content/uploads) via the mangboard plugin's upload endpoint; monitor server logs for POST requests to upload-related endpoints from authenticated users with minimal privileges.","tags":["web-shell","file-upload","rce","auth-bypass","wordpress-plugin"],"model":"garnet-coder","analyzedAt":"2026-10-24T08:49:28.613Z"}}