CVE-2026-109219
Received Received - Intake

Arbitrary File Upload in Mang Board WordPress Plugin

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Wordfence

Description
The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.4 via the mbw_file_upload function. This is due to missing file extension validation on the attacker-supplied image_path parameter, whose basename-derived file name bypasses the extension allowlist applied only to the separate file_name parameter. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the board to be configured to allow guest posts, which is the plugin's default mode; the required nonce is printed on every public board page, making it readable by any unauthenticated visitor without a WordPress login.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-109219
EUVD
EUVD-2026-102636

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kitae-park Mang Board 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Mang Board WordPress plugin has an arbitrary file upload vulnerability in versions up to 2.4.4. It allows unauthenticated attackers to upload executable files by bypassing file extension checks. The issue occurs because the plugin only validates the file_name parameter but not the image_path parameter, which can be manipulated to upload malicious files. Remote code execution is possible if the board allows guest posts, which is enabled by default.

Detection Guidance

Check WordPress installations for the Mang Board plugin versions up to 2.4.4. Inspect uploaded files for unexpected extensions or executable content. Review server logs for suspicious file uploads or remote code execution attempts.

Impact Analysis

Attackers could upload malicious files to your WordPress site, leading to remote code execution. This could allow them to take control of your website, steal data, or use it for further attacks. If your site allows guest posts, which is the default setting, you are at higher risk.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and security. A successful exploit may result in the exposure of sensitive user data, leading to legal penalties, fines, and reputational damage.

Mitigation Strategies

Update the Mang Board plugin to the latest version beyond 2.4.4. Disable guest posts if not required. Implement strict file upload validation to block executable files. Monitor for unauthorized file uploads or suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109219. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart