Missing Authorization Vulnerability in Mang Board Plugin for WordPress

CVE-2026-75977

What is CVE-2026-75977?

The Mang Board WP plugin for WordPress suffers from a Missing Authorization vulnerability due to a flaw in HMAC generation within the mbw_get_hash_key() function. This flaw uses the current user's identity instead of the cookie username parameter for logged-in WordPress users. Combined with the insufficient validation process in mbw_validate_auth_cookie(), this vulnerability allows authenticated attackers with subscriber-level access or higher to forge administrator authentication cookies. Consequently, attackers could gain unauthorized access, change administrator passwords, and potentially take control of the entire site.

References