CVE-2026-111834

Summary

The Mang Board WP plugin (versions through 2.4.4) allows authenticated users with low privileges to upload files of any type, including dangerous web shell scripts, due to missing file type restrictions.

Exploitability

Exploitation requires valid low-privilege credentials and no user interaction; the vulnerability is straightforward to exploit once access is obtained.

Blast radius

Successful exploitation enables remote code execution on the web server, leading to full compromise of confidentiality, integrity, and availability of the affected system.

Detection

Look for unexpected PHP, ASPX, or other executable web shell files uploaded to publicly accessible directories (e.g., wp-content/uploads) via the mangboard plugin's upload endpoint; monitor server logs for POST requests to upload-related endpoints from authenticated users with minimal privileges.

Prioritized remediation

Upgrade to Mang Board WP version 2.4.5 or later, which includes a fix for this unrestricted file upload issue.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.