CVE-2026-75977: Mang Board WP <= 2.3.7 - Authenticated (Subscriber+) Privilege Escalation to Forged Authentication Cookie
The Mang Board WP plugin for WordPress is vulnerable to Missing Authorization via Authentication Cookie Forgery in all versions up to, and including, 2.3.7. This is due to flawed HMAC generation in the mbwgethashkey() function that uses the current user's identity instead of the cookie username parameter when a WordPress user is logged in, combined with insufficient validation in mbwvalidateauthcookie(). This makes it possible for authenticated attackers, with subscriber-level access and above, to forge administrator authentication cookies and change administrator passwords to achieve complete site takeover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mang Board WP (WordPress plugin)to a version that resolves this vulnerability.Fixed in 2.3.7 - Configuration
Upgrade the Mang Board WP plugin to a version where the Missing Authorization via Authentication Cookie Forgery issue is fixed (vulnerable in all versions up to and including 2.3.7).
WordPress Authentication cookie forging mitigation (Missing Authorization via Authentication Cookie Forgery) = Apply Mang Board WP patch/fix for versions > 2.3.7
Event History
Frequently Asked Questions
Can exploitation be performed remotely without user interaction?
Yes. The CVSS vector indicates network-based exploitation with low attack complexity and no user interaction, but the attacker must first have an authenticated WordPress account with at least Subscriber-level access.