Mang Board EUVD-2026-100913

A publicly accessible page must render the [mb_board] shortcode; exploitation is an unauthenticated POST to that page abusing the '<mode>_type' (e.g. foo_type) parameter, with no nonce or capability check enforced on the shortcode render path. Local inclusion of already-present .php files (for access-control bypass or sensitive data disclosure) requires no further conditions. Achieving full code execution additionally requires a standard PHP installation exposing pearcmd.php, or the ability to upload .php file types that can then be included - these conditions limit the RCE outcome (and underlie the vendor's AC:H) even though the underlying LFI is unauthenticated and easy to trigger.

This is a genuine high-priority issue, not a CVSS-inflated paper risk. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1) confirms a network-reachable, unauthenticated flaw with full confidentiality/integrity/availability impact. The AC:H rating conflicts with the description's claim that 'exploitation is trivial' - this is a notable tension: the LFI primitive itself is trivial and unauthenticated (supporting AC:L), but achieving full RCE/high impact depends on a server-side condition (a standard PHP install exposing pearcmd.php, or the ability to upload .php files), which plausibly justifies the vendor's AC:H. Verify this interpretation with Wordfence. No EPSS score was provided and there is no CISA KEV listing, so there is no public-exploit-probability signal either way; absence of EPSS/KEV should not be read as low risk given the unauthenticated, remote nature and the explicit pearcmd.php RCE technique described. No public exploit was identified at time of analysis and no SSVC decision data was supplied. Net: treat as an urgent patch for any site running a public [mb_board] shortcode, while noting the AC/'trivial' conflict and missing exploitation-probability telemetry.

An unauthenticated attacker locates a public WordPress page that renders the [mb_board] shortcode and sends a crafted POST request manipulating the '<mode>_type' parameter to make the plugin include an arbitrary local .php file. On a standard PHP installation, the attacker abuses pearcmd.php to first write an attacker-controlled payload file and then include it in the same request, achieving remote code execution. No public exploit code was identified at time of analysis, but the description documents a complete, single-request RCE technique.