Mang Board CVE-2026-109219

Exploitation requires the Mang Board to be configured to allow guest posts - which the description states is the plugin's default mode - and targets the mbw_file_upload function by abusing the image_path parameter, whose basename-derived filename bypasses the extension allowlist that is only enforced on the separate file_name parameter. A valid nonce is required but is not a meaningful barrier because it is printed on every public board page and readable by any unauthenticated visitor. The primary limiting factor is configuration: an administrator who has disabled guest posting removes the unauthenticated attack surface. Affected scope is all versions up to and including 2.4.4.

All signals point to a genuine high priority. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes remote, unauthenticated, low-complexity exploitation with full C/I/A impact, and the description corroborates it: the attacker needs no WordPress login because the required nonce is printed on every public board page, and the vulnerable guest-post mode is the plugin's default. This is a CWE-434 arbitrary file upload leading to RCE, which is historically among the most reliably weaponized WordPress plugin bug classes. No EPSS score, KEV listing, or public POC was provided in the input, so there is no confirmed active exploitation yet - the risk assessment here is driven by the vector and the low barrier to exploitation rather than observed in-the-wild activity. The CVSS vector and the description are consistent (both indicate unauthenticated network access against default configs), with no contradictions to flag. The only mitigating factor is deployment scope: Mang Board is a niche, largely Korean-market bulletin-board plugin, so the aggregate internet-wide risk is lower than a comparable flaw in a ubiquitous plugin, but any exposed instance should be patched urgently.

An unauthenticated attacker browses to a public Mang Board page, reads the nonce embedded in the page HTML, and submits a request to the mbw_file_upload function supplying a malicious image_path whose basename is a PHP file; because extension validation is only applied to the separate file_name parameter, the executable file is written to the server. The attacker then requests the uploaded file directly to achieve remote code execution. No public exploit code was identified at time of analysis, but the low complexity and publicly readable nonce make reliable exploitation straightforward.