CVE-2026-104909

8.1High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.1High

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-98

Impact

Unauthenticated remote attackers can execute arbitrary PHP code or read local files on the server. They only need network access to POST to any page rendering the public [mb_board] shortcode.

Root cause

The plugin unsafely includes local .php files specified by user-supplied mode type parameters without proper validation or capability checks during shortcode rendering.

Affected systems

Mang Board plugin for WordPress up to, and including, 2.4.3

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade Mang Board to a version newer than 2.4.3. If you cannot patch immediately, deactivate the Mang Board plugin or remove pages displaying the [mb_board] shortcode.

shell

$ wp plugin update mangboard

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the '<mode>_type (e.g. foo_type)' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation is trivial via an unauthenticated POST to any page rendering a public [mb_board] shortcode, as no nonce or capability check is enforced on the shortcode render path; on servers with a standard PHP installation, pearcmd.php can be leveraged to write and then include an attacker-controlled payload file in a single request.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-104909