Mang Board WP EUVD-2026-66335

Exploitation requires the attacker to hold a valid WordPress account at subscriber level or above on the target site - unauthenticated exploitation is not possible per the CVSS PR:L vector. The Mang Board WP plugin must be installed and active, and the victim site must expose the plugin's custom cookie validation flow (which activates when the plugin's board or user functionality is in use, as evidenced by the affected code paths in func.board.php, func.user.php, and mb-template.php). No other non-default configuration is required beyond plugin activation and a subscriber-level account. The primary limiting factor is the authentication prerequisite: sites that disable open user registration and restrict all accounts to trusted individuals significantly reduce their exposure, since exploitation then requires either a malicious insider or a pre-existing account compromise. There is no requirement for specific operating system, hosting platform, or WordPress version beyond plugin activation.

The CVSS 8.8 High vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately models this vulnerability. The single meaningful friction point is PR:L - an attacker must hold at minimum a subscriber-level WordPress account on the target site, which on sites with open registration may be trivially obtained. Attack complexity is genuinely low: exploiting the flaw requires understanding the HMAC generation logic (derivable from the publicly browsable Trac source code), crafting a cookie, and submitting it. No EPSS data was provided in the input; KEV status is negative and no public exploit code has been identified at time of analysis, suggesting this has not yet seen opportunistic mass exploitation. However, the Wordfence disclosure and multiple source-code-level references substantially lower the barrier to independent exploit development. Sites permitting open user registration or hosting any untrusted authenticated users are at elevated practical risk. The full C:H/I:H/A:H impact reflects that admin-level access over a WordPress site constitutes complete control: content modification, credential harvesting, webshell installation, and full availability disruption are all within reach post-exploitation.

An attacker registers a free subscriber account on a WordPress site running Mang Board WP ≤ 2.3.7, or compromises an existing low-privilege account. While authenticated as a subscriber, the attacker leverages the publicly browsable plugin source code to understand the flawed HMAC construction in mbw_get_hash_key(), then crafts a custom authentication cookie that names the site administrator as its subject but signs it using HMAC material derived from the attacker's own active session. Submitting this forged cookie causes mbw_validate_auth_cookie() to grant administrator-level access, at which point the attacker changes the administrator password and installs a backdoor for persistent control of the site.