Mang Board WordPress plugin: Unauthenticated arbitrary file upload
Summary
The Mang Board WordPress plugin up to and including version 2.4.4 does not validate the file extension of the image_path parameter in the mbw_file_upload function. An unauthenticated attacker can upload files that may be executable, which can lead to remote code execution on the web server. Exploitation requires the board to allow guest posts, which is the default mode, and the required nonce is printed on every public board page.
Affected
- Mang Board WordPress plugin, versions up to and including 2.4.4
- Default configuration with guest posting enabled
Fixed in
- Fixed in version 2.4.5 according to Patchstack
- The vendor changelog labels are inconsistent (2.5.6 (2.4.5), 2.5.7 (2.4.6)); confirm the current release on the plugin page
Workaround
- Disable guest posting in the board settings
- Use a virtual patch or WAF rule if available (Patchstack reports protection, specifics unverified)
- Check upload directories for unexpected script files and review recent uploads
Exploitation
- No confirmed exploitation known; not listed in CISA KEV at the time of research
- CISA SSVC: exploitation none, automatable yes, total technical impact
- Patchstack expects exploitation (forecast, not evidence)
- No public proof-of-concept found; status unknown
Our recommendation
- Inventory all WordPress sites with Mang Board and check whether a public board is in use
- Update Mang Board to the latest release immediately
- Disable guest posting until the update is applied
- Check upload directories for unexpected or executable files and investigate any findings
- Monitor web server logs for suspicious upload requests
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence threat intelligence record www.wordfence.com
- Patchstack vulnerability entry patchstack.com
- WordPress.org plugin page (Mang Board) wordpress.org
- Plugin trac changeset plugins.trac.wordpress.org
- Vulnerable code in version 2.4.4 (mb-board.php) plugins.trac.wordpress.org
- Vulnerable code in version 2.4.4 (func.api.php) plugins.trac.wordpress.org
- Vulners CVE record vulners.com
- Hol.org CVE entry (CVE-2026-111834 duplicate) hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:44.
Original description (NVD)
The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in version 2.4.4 via the mbw_file_upload function. This is due to missing file extension validation on the attacker-supplied image_path parameter, whose basename-derived file name bypasses the extension allowlist applied only to the separate file_name parameter. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the board to be configured to allow guest posts, which is the plugin's default mode; the required nonce is printed on every public board page, making it readable by any unauthenticated visitor without a WordPress login.
NVD references (8)
- https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/api/mb-board.php#L428
- https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L902
- https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L903
- https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L972
- https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/mb-actions.php#L520
- https://plugins.trac.wordpress.org/changeset/3743247/mangboard/trunk/includes/functions/func.api.php
- https://wordpress.org/plugins/mangboard/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/1e4f4860-b4c9-4f41-b1d0-0b2da8c88b99?source=cve
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.