Local File Inclusion Vulnerability in Mang Board Plugin for WordPress

CVE-2026-104909

What is CVE-2026-104909?

The Mang Board plugin for WordPress is susceptible to a Local File Inclusion vulnerability in all versions up to and including 2.4.3. This flaw arises from the misuse of the '_type' parameter, enabling unauthenticated attackers to potentially include and execute arbitrary PHP files on the server. This vulnerability facilitates bypassing access controls, accessing sensitive information, and executing malicious PHP code. Exploit methods involve exposing the vulnerability through a simple unauthenticated POST request to any public page using the [mb_board] shortcode. No nonce or capability verification is present, thereby heightening the risk. On servers with a standard PHP setup, tools like pearcmd.php can be manipulated to upload and include attacker-driven payloads, making exploitation notably straightforward.

References