Arbitrary File Upload Vulnerability in Mang Board Plugin for WordPress
CVE-2026-109219

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Mang Board
Vendor
CVE Published:
16 October 2026

What is CVE-2026-109219?

The Mang Board plugin for WordPress is susceptible to an Arbitrary File Upload vulnerability in versions up to 2.4.4. This flaw arises from insufficient validation of the file extension within the mbw_file_upload function, allowing attackers to manipulate the image_path parameter. As a result, unauthorized users can upload potentially executable files, paving the way for remote code execution. The default configuration of the board permits guest posts, which heightens the risk, as the nonce necessary for file uploads is exposed on all public board pages, accessible to any visitor without authentication.

Affected Version(s)

Mang Board 0 <= 2.4.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/mangboard/tags...
https://plugins.trac.wordpress.org/browser/mangboard/tags...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Osman Hussein
.