The Mang Board WordPress plugin, versions up to and including 2.4.4, has a critical (CVSS 9.8) flaw that lets unauthenticated attackers upload files that may be executable, which makes remote code execution possible.
What Is It
CVE-2026-109219 is an arbitrary file upload vulnerability (CWE-434) in the mbw_file_upload function of the Mang Board plugin for WordPress. The plugin checks file extensions against an allowlist, but only on the file_name parameter. It does not validate the extension on the attacker-supplied image_path parameter. Because the stored file name comes from the basename of image_path, an attacker can bypass the allowlist and upload files that may be executable.
Wordfence reported the issue. NVD published the record on 2026-10-16 with status "Received."
Why It Matters
- CVSS 3.1: 9.8 Critical (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - No authentication required: Exploitation needs no WordPress login.
- Vulnerable by default: The attack requires the board to allow guest posts, which is the plugin's default mode.
- Nonce provides no protection: The required nonce is printed on every public board page, so any unauthenticated visitor can read it.
- Impact: A successful upload of an executable file can lead to remote code execution, with high impact to confidentiality, integrity and availability.
The sources cited here do not report active exploitation. Even so, the attack is low-complexity, unauthenticated and works on default settings, so exposed sites should treat it as urgent.
What's Vulnerable
| Vendor | Product | Affected Versions |
|---|---|---|
| kitae-park | Mang Board (WordPress plugin) | All versions ≤ 2.4.4 |
The risk is highest on sites where guest posting is enabled, which is the default.
Patch Status
The NVD record lists all versions through 2.4.4 as affected. It references a WordPress plugin repository changeset (3743247) that modifies func.api.php in trunk, but it does not name a fixed release version. None of the cited sources lists a CISA-mandated remediation action or due date.
Recommended steps: - Update Mang Board to a release later than 2.4.4 once the WordPress plugin page confirms one includes the fix. - Until then, disable guest posting on Mang Board boards, or deactivate the plugin. - Check upload directories for unexpected executable files.