CVE-2026-109219: Mang Board <= 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter

Q: Which deployments are exposed by default?

Installations running Mang Board 2.4.4 or earlier are exposed when guest posts are enabled. Guest posting is the plugin's default mode, so public board pages are likely reachable without requiring a WordPress login.

Q: What does an attacker need to exploit this issue?

An attacker needs network access to a public board page and does not need a WordPress account or other privileges. The required nonce is displayed on every public board page and can be read by an unauthenticated visitor.

Q: What is the practical impact of a successful upload?

An attacker may upload files that are executable because the image_path parameter is not subject to effective file-extension validation. This can make remote code execution possible, with potential impact to confidentiality, integrity, and availability.

Q: What mitigation is available if an update cannot be applied immediately?

Disable guest posts for Mang Board to remove the stated exploitation prerequisite. Restricting public access to board pages would also prevent unauthenticated visitors from obtaining the nonce described in the advisory.

Published Oct 16, 2026

Updated

The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.4 via the mbwfileupload function. This is due to missing file extension validation on the attacker-supplied imagepath parameter, whose basename-derived file name bypasses the extension allowlist applied only to the separate filename parameter. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the board to be configured to allow guest posts, which is the plugin's default mode; the required nonce is printed on every public board page, making it readable by any unauthenticated visitor without a WordPress login.

Affected Software

1 affected component

Mang Board Mang Board<=2.4.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
Disable guest posts on the board to prevent unauthenticated exploitation.
Mang Board allow guest posts = false

Event History

Oct 16, 2026

CVE Published

via MITRE·04:26 AM

Data Sourced

via MITRE·04:26 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed by default?

Installations running Mang Board 2.4.4 or earlier are exposed when guest posts are enabled. Guest posting is the plugin's default mode, so public board pages are likely reachable without requiring a WordPress login.

What does an attacker need to exploit this issue?

An attacker needs network access to a public board page and does not need a WordPress account or other privileges. The required nonce is displayed on every public board page and can be read by an unauthenticated visitor.

What is the practical impact of a successful upload?

An attacker may upload files that are executable because the image_path parameter is not subject to effective file-extension validation. This can make remote code execution possible, with potential impact to confidentiality, integrity, and availability.

What mitigation is available if an update cannot be applied immediately?

Disable guest posts for Mang Board to remove the stated exploitation prerequisite. Restricting public access to board pages would also prevent unauthenticated visitors from obtaining the nonce described in the advisory.

CVE-2026-109219: Mang Board <= 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed by default?

What does an attacker need to exploit this issue?

What is the practical impact of a successful upload?

What mitigation is available if an update cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed by default?

What does an attacker need to exploit this issue?

What is the practical impact of a successful upload?

What mitigation is available if an update cannot be applied immediately?