{
 "id": "WPSEC-2026-0877",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0877/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0877/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0877/index.md",
 "title": "Mang Board <= 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter",
 "description": "The Mang Board plugin for WordPress is vulnerable to arbitrary file upload via the 'image_path' parameter of the base64 image (img64) upload performed when modifying a board post in all versions up to, and including, 2.4.4, due to the user-supplied path controlling both the target directory and the file name, including its extension, without extension validation, sanitization or confinement to the upload directory. This makes it possible for unauthenticated attackers who can edit their own post, which guests can do on boards that allow guest posting (the default write level), to write files with arbitrary extensions, such as PHP files with image headers, to arbitrary locations on the server, which may lead to remote code execution.",
 "plugin": {
  "slug": "mangboard",
  "name": "Mang Board",
  "full_name": "Mang Board",
  "wordpress_org": "https://wordpress.org/plugins/mangboard/",
  "advisories_url": "https://wpsec.com/vuln/plugin/mangboard/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/mangboard"
 },
 "type": "UPLOAD",
 "cwe": [
  "CWE-434"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 9.8,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "severity": "Critical"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.4.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.4.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.4.5",
 "remediation": "Update to 2.4.5 or later.",
 "fix_released": "2026-10-13T08:16:40+00:00",
 "published": "2026-10-14T08:47:41+00:00",
 "updated": "2026-10-13T12:13:25.096879+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0877/",
  "https://plugins.svn.wordpress.org/mangboard/tags/2.4.5/",
  "https://wordpress.org/plugins/mangboard/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/mangboard",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-14"
 }
}