CVE-2026-109219

Summary

The Mang Board plugin allows unauthenticated attackers to upload arbitrary files, including executable ones, due to insufficient validation of the image_path parameter. This vulnerability can lead to remote code execution on affected WordPress sites.

Exploitability

Exploitation is straightforward for unauthenticated attackers who can access public board pages, as the required nonce is publicly exposed and guest posting is enabled by default.

Blast radius

The vulnerability affects all WordPress installations using Mang Board plugin versions up to 2.4.4, with widespread impact since guest posting is enabled by default and no authentication is required for exploitation.

Detection

Monitor for unusual file uploads in the wp-content/uploads directory, particularly executable files (.php, .jsp, .asp) with names derived from image_path parameters, and check web server logs for requests to the mbw_file_upload endpoint with suspicious file extensions.

Prioritized remediation

Upgrade to version 2.4.5 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.