Mang Board WP CVE-2026-109698

The target must be running the Mang Board WP plugin at version 2.4.4 or earlier (fixed version not stated in available data). The description does not name the specific vulnerable parameter, endpoint, or feature, so the exact injection point is unconfirmed. Per the provided CVSS vector (PR:N/UI:N), no authentication or user interaction is claimed to be required, which would allow remote unauthenticated exploitation; however, this privilege rating is unusually permissive for a WordPress plugin SQLi and is not corroborated by the description text, so defenders should verify whether some authenticated role (e.g., Subscriber) is actually required before deprioritizing based on auth. No non-default configuration is indicated as a prerequisite.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, score 9.3) describes a network-reachable, low-complexity, unauthenticated SQL injection (CWE-89) with a scope change and high confidentiality impact - on paper a critical-priority issue. However, the real-world signals temper this: there is no EPSS score provided, no CISA KEV listing, and no public proof-of-concept referenced, so there is no public exploit identified at time of analysis. The single source is a Patchstack advisory, which is a credible vulnerability-research vendor but represents one source rather than confirmed field exploitation. Two points warrant verification: (1) the PR:N (unauthenticated) rating is unusually generous for a WordPress plugin SQLi - many Patchstack-reported plugin SQLi flaws actually require at least Subscriber/authenticated access, and the terse description ('allows SQL Injection') does not confirm the privilege level, so verify the required authentication with the Patchstack advisory; (2) the I:N/A:L with C:H combination is atypical for SQLi, which usually yields high confidentiality impact only - the A:L and S:C warrant scrutiny. Net: credible high-severity flaw worth prompt patching for anyone running the plugin, but widespread opportunistic exploitation is not yet evidenced, and the deployment footprint is small.

A remote attacker sends a crafted HTTP request to a vulnerable Mang Board WP endpoint, injecting SQL through an improperly neutralized parameter to read sensitive data from the WordPress database (e.g., user records, password hashes, session/secret data). The CVSS vector indicates network-based, low-complexity exploitation requiring no user interaction; no public proof-of-concept is referenced, so exploitation would currently require an attacker to independently develop the injection payload.