Mang Board WP EUVD-2026-107281

Exploitation requires an authenticated WordPress account with at least low-level privileges (CVSS PR:L) on a site running the Mang Board WP plugin version 2.4.4 or earlier; the attacker leverages the plugin's file-upload functionality to upload a dangerous file type (e.g., a PHP web shell) that the plugin fails to restrict. The principal limiting factor is the authentication requirement - anonymous, unauthenticated exploitation is not supported by the vector - so risk is concentrated on sites that allow untrusted or self-service user registration; no special non-default configuration is indicated beyond having the vulnerable plugin installed and active.

This is a genuine high-priority issue, not merely a high-CVSS paper risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C) describes a network-reachable, low-complexity, no-user-interaction flaw requiring only low privileges, with a changed scope - consistent with an authenticated WordPress user uploading a web shell that compromises the underlying server. CWE-434 (unrestricted dangerous file upload) leading to web shell execution reliably yields remote code execution, which is why C:H/I:H/A:H and the 9.9 score are credible. However, the exploitation signals are incomplete: no EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The low-privilege requirement (PR:L) is the key mitigating factor - an attacker must already hold a valid, if low-level, account on the WordPress site, which limits purely anonymous mass exploitation. The practical risk is therefore high for sites that permit untrusted user registration, but lower for closed sites. No conflicting signals were detected between the CVSS vector and the description; both point to authenticated remote exploitation.

An attacker who holds a low-privilege account on a WordPress site running the Mang Board WP plugin (≤2.4.4) abuses the plugin's file-upload feature to upload a PHP web shell, bypassing file-type restrictions. The attacker then requests the uploaded file directly to execute arbitrary code and gain control of the web server. No public exploit code was identified in the provided data, and exploitation requires a valid authenticated session (PR:L).