CVE-2026-109698

9.3Critical

Published 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.3Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-89

Impact

Unauthenticated remote attackers can execute arbitrary SQL queries against the database to extract data or cause denial of service. They only need network access to the exposed WordPress site.

Root cause

User input is improperly neutralized before being concatenated into an SQL command.

Affected systems

Mang Board WP through 2.4.4

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Fix & remediation

Upgrade Mang Board WP to a version newer than 2.4.4 if available. If no fixed release is available, immediately deactivate and uninstall the plugin.

shell

$ wp plugin deactivate mangboard

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kitae Park Mang Board WP mangboard allows SQL Injection.This issue affects Mang Board WP: from n/a through 2.4.4.

References

https://patchstack.com/database/wordpress/plugin/mangboard/vulnerability/wordpress-mang-board-wp-plugin-2-4-4-sql-injection-vulnerability?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-109698