CVE-2026-104909

Received Received - Intake

Local File Inclusion in Mang Board WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Wordfence

Description

The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the '<mode>_type (e.g. foo_type)' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation is trivial via an unauthenticated POST to any page rendering a public [mb_board] shortcode, as no nonce or capability check is enforced on the shortcode render path; on servers with a standard PHP installation, pearcmd.php can be leveraged to write and then include an attacker-controlled payload file in a single request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104909

EUVD

EUVD-2026-100913

Affected Vendors & Products

Vendor	Product	Version / Range
kitae-park	Mang	Board 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-98	The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Attack-Flow Graph

Executive Summary

The Mang Board WordPress plugin up to version 2.4.3 has a Local File Inclusion vulnerability via the '<mode>_type' parameter. Unauthenticated attackers can include and execute arbitrary PHP files on the server by exploiting this flaw. This allows them to run malicious PHP code, bypass access controls, steal sensitive data, or gain full control of the server.

Detection Guidance

Check WordPress installations for the Mang Board plugin versions up to 2.4.3. Look for unauthorized PHP file inclusions in web server logs, especially POST requests to pages with [mb_board] shortcode. Inspect uploaded files for unexpected .php files in directories accessible via the plugin.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on your server, potentially leading to complete system compromise. They could steal sensitive data, install malware, deface your website, or use your server for further attacks. Since exploitation is possible without authentication, any site using the vulnerable plugin is at immediate risk.

Compliance Impact

This vulnerability could lead to severe compliance violations. GDPR requires protecting personal data; a breach could result in fines up to 4% of global revenue. HIPAA mandates strict access controls for health data; unauthorized access would violate compliance. Both standards require timely breach notification, which this vulnerability could trigger.

Mitigation Strategies

Immediately update the Mang Board plugin to the latest version beyond 2.4.3. Disable the plugin if not essential. Restrict file uploads to non-PHP types. Review server logs for signs of exploitation. Consider temporary removal of the [mb_board] shortcode usage until patched.

Hi! I’m here to help you understand CVE-2026-104909. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70