Mang Board WP EUVD-2026-69938

Exploitation requires two conditions to be satisfied simultaneously: (1) the target WordPress site must have the Mang Board WP plugin installed and active at version ≤ 2.3.8, and (2) a WordPress administrator must be actively authenticated and must visit an attacker-controlled page during that session - the UI:R metric reflects this mandatory victim-interaction step. There are no special server configuration requirements beyond the plugin being installed. Exploitation is bounded by the social-engineering prerequisite; unauthenticated site visitors cannot be used as attack vectors, and the attack fails entirely if the administrator is not logged in when the malicious page is visited.

The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is consistent with the CSRF class: the attacker needs no server-side credentials, only the ability to lure an authenticated administrator to an attacker-controlled page. The high C/I/A scores reflect realistic worst-case outcomes if the forged request targets admin-level board management functions - such as creating privileged accounts, modifying content, or wiping data. Real-world risk is tempered by the mandatory user-interaction requirement; even a mid-sized municipal IT team in opole should treat this as urgent if their administrators browse untrusted content while authenticated, but the flaw is materially less dangerous than server-side unauthenticated remote code execution. EPSS data is absent from the input, KEV status is not listed, and no public exploit code has been confirmed - all signals point to low-to-moderate exploitation likelihood in the near term for this niche plugin.

An attacker identifies a WordPress site running Mang Board WP ≤ 2.3.8 and crafts a web page containing hidden auto-submitting HTML forms targeting the plugin's admin action endpoints. The attacker distributes a link to this page via phishing email or social media to the site administrator; when the administrator visits the page while logged into WordPress, the browser silently submits the forged request with the administrator's session cookies, causing the plugin to execute the unauthorized action. No public proof-of-concept code has been identified in the available data.