# Mang Board <= 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter

- **ID:** WPSEC-2026-0877
- **Plugin:** Mang Board (`mangboard`), https://wordpress.org/plugins/mangboard/
- **Affected versions:** all versions before 2.4.5
- **Fixed in:** 2.4.5 (Update to 2.4.5 or later.)
- **Severity:** Critical 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-434
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/mangboard
- **Fix released:** 2026-10-13
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0877/

## Description

The Mang Board plugin for WordPress is vulnerable to arbitrary file upload via the 'image_path' parameter of the base64 image (img64) upload performed when modifying a board post in all versions up to, and including, 2.4.4, due to the user-supplied path controlling both the target directory and the file name, including its extension, without extension validation, sanitization or confinement to the upload directory. This makes it possible for unauthenticated attackers who can edit their own post, which guests can do on boards that allow guest posting (the default write level), to write files with arbitrary extensions, such as PHP files with image headers, to arbitrary locations on the server, which may lead to remote code execution.

## References

- https://wpsec.com/vuln/WPSEC-2026-0877/
- https://plugins.svn.wordpress.org/mangboard/tags/2.4.5/
- https://wordpress.org/plugins/mangboard/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0877/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.