Mang Board <= 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter
- ID
- WPSEC-2026-0877
- Plugin
- Mang Board (mangboard)
- Affected
- all versions before 2.4.5
- Remediation
- Update to 2.4.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-434
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-14
- Attack surface
- Mang Board on WPSec AttackSurface
- Fix released
- Published
Description
The Mang Board plugin for WordPress is vulnerable to arbitrary file upload via the 'image_path' parameter of the base64 image (img64) upload performed when modifying a board post in all versions up to, and including, 2.4.4, due to the user-supplied path controlling both the target directory and the file name, including its extension, without extension validation, sanitization or confinement to the upload directory. This makes it possible for unauthenticated attackers who can edit their own post, which guests can do on boards that allow guest posting (the default write level), to write files with arbitrary extensions, such as PHP files with image headers, to arbitrary locations on the server, which may lead to remote code execution.
References
- https://wpsec.com/vuln/WPSEC-2026-0877/
- https://plugins.svn.wordpress.org/mangboard/tags/2.4.5/
- https://wordpress.org/plugins/mangboard/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS