CVE-2026-109219

9.8Critical

Published 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-434

Impact

Unauthenticated attackers can achieve remote code execution by uploading executable files. They only need network access to a board configured for guest posting (the default setting), as the necessary nonce is exposed publicly.

Root cause

The mbw_file_upload function checks file extensions against an allowlist using the file_name parameter but saves the file using a basename derived from the unvalidated image_path parameter.

Affected systems

Mang Board plugin for WordPress versions up to and including 2.4.4

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade Mang Board to a version newer than 2.4.4 once available. As an immediate workaround, disable guest posting on all boards or deactivate the plugin.

shell

$ wp plugin update mangboard

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.4 via the mbw_file_upload function. This is due to missing file extension validation on the attacker-supplied image_path parameter, whose basename-derived file name bypasses the extension allowlist applied only to the separate file_name parameter. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the board to be configured to allow guest posts, which is the plugin's default mode; the required nonce is printed on every public board page, making it readable by any unauthenticated visitor without a WordPress login.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109219