Description

The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.4 via the mbw_file_upload function. This is due to missing file extension validation on the attacker-supplied image_path parameter, whose basename-derived file name bypasses the extension allowlist applied only to the separate file_name parameter. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the board to be configured to allow guest posts, which is the plugin's default mode; the required nonce is printed on every public board page, making it readable by any unauthenticated visitor without a WordPress login.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-16T05:17:29.100Z",
  "pubdate": "2026-10-16T05:17:29.100Z",
  "executiveSummary": "The Mang Board plugin for WordPress, in versions up to and including 2.4.4, contains a critical arbitrary file upload vulnerability. The flaw allows unauthenticated remote attackers to upload executable files to the server, facilitating Remote Code Execution (RCE).\nThe vulnerability resides in the mbw_file_upload function, which fails to adequately sanitize the 'image_path' parameter. Because the application processes the basename of this parameter without proper extension validation, it bypasses security checks intended to restrict file types. Consequently, an attacker can bypass the existing allowlist mechanism applied to the 'file_name' parameter.\nThe exploitation of this vulnerability is significantly facilitated by the plugin's default configuration, which permits guest posts. Furthermore, the required security nonce is publicly exposed on every board page, enabling any unauthenticated visitor to obtain the necessary credentials for the request. Successful exploitation grants an attacker the ability to execute arbitrary code within the server's environment, leading to full site compromise, unauthorized data access, and potential lateral movement within the hosting infrastructure. Given the lack of authentication requirements and the ease of nonce acquisition, this vulnerability poses a severe risk to any WordPress instance utilizing affected versions of the Mang Board plugin.",
  "technicalDetails": "The vulnerability is located in the mbw_file_upload function within the Mang Board WordPress plugin. The root cause is an improper input validation logic error where the function employs two different parameters, 'file_name' and 'image_path', for file handling. While the 'file_name' parameter is subjected to a strict file extension allowlist, the 'image_path' parameter is processed using a basename function, and the resultant file name is written to the server's filesystem without equivalent validation.\nThe attack flow begins with the discovery of the required security nonce, which is printed in the source code of any public-facing page utilizing the Mang Board plugin. Because the plugin defaults to allowing guest contributions, no prior authentication or administrative privilege escalation is necessary to interact with the vulnerable function.\nAn attacker crafts a multipart/form-data POST request targeting the mbw_file_upload endpoint. By manipulating the 'image_path' parameter, the attacker provides a malicious payload, such as a PHP web shell, formatted to bypass the insufficient sanitization logic. Because the application logic relies on the basename of 'image_path' for file creation, the system fails to verify that the file extension complies with security policies.\nOnce the file is uploaded, it is stored in an accessible directory on the web server. The attacker then triggers the execution of the uploaded file by navigating to its URI via a standard HTTP GET request. The web server interprets the uploaded file as legitimate code, resulting in Remote Code Execution (RCE) with the privileges of the web server user (typically www-data or similar).\nPost-exploitation, an attacker can achieve complete system compromise. This includes, but is not limited to, the exfiltration of sensitive database content, the modification of site files, the installation of persistent backdoors, and the utilization of the compromised server as a pivot point for further network attacks. The vulnerability affects all versions of Mang Board up to and including 2.4.4. There are no mitigations natively applied in these versions to prevent the bypass of the extension check via the 'image_path' parameter."
}