IT SBIT Services
Schneeberger
DEEN
CVE tracker

Mang Board WordPress plugin: Unauthenticated Local File Inclusion

CVE-2026-104909High 8.1

← All vulnerabilities

Summary

The Mang Board plugin for WordPress, versions up to and including 2.4.3, contains a Local File Inclusion vulnerability in the '<mode>_type' parameter. An unauthenticated attacker can include and execute arbitrary .php files on the server by sending a crafted request to a page that renders the public [mb_board] shortcode. Depending on the server configuration and existing files, this can bypass access controls, expose sensitive data or lead to remote code execution.

Affected

  • Mang Board plugin for WordPress, all versions up to and including 2.4.3
  • Default configuration is unaffected according to the CNA record; the affected range is 0 to <= 2.4.3

Fixed in

Unknown. No source confirmed a fixed release. Later versions (2.4.4 and 2.4.5) have not been verified as fixed.

Workaround

  • Deactivate and remove the plugin until a fixed version is confirmed.
  • If the plugin must stay, apply virtual patching with a web application firewall (for example Wordfence or Patchstack rules). No specific rule for this CVE has been confirmed.
  • Restrict PHP file upload paths and keep PHP and WordPress core up to date.

Exploitation

  • CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
  • No CISA KEV entry found in the searches performed; this is a snapshot, not a current check.
  • No public proof of concept found in the searches performed.
  • EPSS about 0.01.
  • Mass exploitation: unknown.
  • Public write-ups describe the attack path as trivial, requiring no authentication, nonce or capability check.

Our recommendation

  • Check inventory for Mang Board on all WordPress sites, including versions up to 2.4.3 and later versions.
  • Deactivate and remove the plugin if no fixed version is confirmed.
  • Check for compromise: unexpected PHP files in uploads or plugin folders, new admin users and unknown outbound connections.
  • Monitor web server logs for unusual requests to pages with the [mb_board] shortcode.
  • Track other open Mang Board CVEs, as several 2026 advisories cover this plugin.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:10.

Original description (NVD)

The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the '<mode>_type (e.g. foo_type)' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation is trivial via an unauthenticated POST to any page rendering a public [mb_board] shortcode, as no nonce or capability check is enforced on the shortcode render path; on servers with a standard PHP installation, pearcmd.php can be leveraged to write and then include an attacker-controlled payload file in a single request.

NVD references (7)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed