EUVD-2026-66335
GHSA-fwqj-5r7m-j49j
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-exploitable with low complexity; PR:L reflects mandatory subscriber authentication; full CIA impact from complete WordPress admin takeover.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The Mang Board WP plugin for WordPress is vulnerable to Missing Authorization via Authentication Cookie Forgery in all versions up to, and including, 2.3.7. This is due to flawed HMAC generation in the mbw_get_hash_key() function that uses the current user's identity instead of the cookie username parameter when a WordPress user is logged in, combined with insufficient validation in mbw_validate_auth_cookie(). This makes it possible for authenticated attackers, with subscriber-level access and above, to forge administrator authentication cookies and change administrator passwords to achieve complete site takeover.
AnalysisAI
Cookie forgery in the Mang Board WP WordPress plugin (≤2.3.7) enables any subscriber-level account holder to forge administrator authentication cookies and change the administrator password, resulting in complete WordPress site takeover. The flaw originates in mbw_get_hash_key(), which generates HMAC material from the currently logged-in user's identity rather than the username embedded in the cookie under validation, while mbw_validate_auth_cookie() performs insufficient verification - allowing the forged cookie to pass as legitimate. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a valid WordPress account at subscriber level or above on the target site - unauthenticated exploitation is not possible per the CVSS PR:L vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 High vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately models this vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a free subscriber account on a WordPress site running Mang Board WP ≤ 2.3.7, or compromises an existing low-privilege account. While authenticated as a subscriber, the attacker leverages the publicly browsable plugin source code to understand the flawed HMAC construction in `mbw_get_hash_key()`, then crafts a custom authentication cookie that names the site administrator as its subject but signs it using HMAC material derived from the attacker's own active session. … |
| Remediation | Update the Mang Board WP plugin to the first release after version 2.3.7, as the upstream fix is represented by WordPress Plugin Trac changeset 3664567 (https://plugins.trac.wordpress.org/changeset/3664567/); however, the exact patched release version number is not independently confirmed from available data and should be verified against the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ae75196d-2128-4da8-a90b-a62454dcdbe9 before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: immediately deactivate and uninstall Mang Board WP plugin across all WordPress installations; audit subscriber account activity and authentication logs for suspicious patterns or recent privilege escalation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mang Board Wp
View allUnauthenticated stored or reflected Cross-Site Scripting in the Mang Board WP WordPress plugin (versions 2.3.4 and earli
Reflected Cross-Site Scripting in the Mang Board WP WordPress plugin (all versions through 2.3.4) allows unauthenticated
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today