Summary
generated automatically from NVD dataThe Mang Board plugin for WordPress, in all versions up to and including 2.4.4, has an arbitrary file upload flaw (CWE-434) in the mbw_file_upload function. The extension allowlist is applied only to the file_name parameter, so a file name derived from the image_path parameter bypasses it, letting unauthenticated attackers upload potentially executable files and possibly achieve remote code execution. It requires guest posts to be enabled, which is the default, and the needed nonce appears on every public board page. The CVSS v3.1 score is 9.8 (CRITICAL).
NVD description
The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.4 via the mbw_file_upload function. This is due to missing file extension validation on the attacker-supplied image_path parameter, whose basename-derived file name bypasses the extension allowlist applied only to the separate file_name parameter. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the board to be configured to allow guest posts, which is the plugin's default mode; the required nonce is printed on every public board page, making it readable by any unauthenticated visitor without a WordPress login.
EPSS · FIRST.org
0.69%probability of exploitation in the next 30 days
Higher than 51% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-16, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 16 oct. 2026
- Updated
- 16 oct. 2026
- Status
- Deferred
- Source
- security@wordfence.com
Weaknesses (CWE)
References (8)
Similar CVEs
Other vulnerabilities of type CWE-434
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.