CVE-2026-109219

The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.4 via the mbw_file_upload function. This is due to missing file extension validation on the attacker-supplied image_path parameter, whose basename-derived file name bypasses the extension allowlist applied only to the separate file_name parameter. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the board to be configured to allow guest posts, which is the plugin's default mode; the required nonce is printed on every public board page, making it readable by any unauthenticated visitor without a WordPress login.

• CWE-434

• https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/api/mb-board.php#L428
• https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L902
• https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L903
• https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L972
• https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/mb-actions.php#L520
• https://plugins.trac.wordpress.org/changeset/3743247/mangboard/trunk/includes/functions/func.api.php
• https://wordpress.org/plugins/mangboard/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1e4f4860-b4c9-4f41-b1d0-0b2da8c88b99?source=cve

Published

Oct 16, 2026

Last Modified

Oct 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-109203LogicalDOC Community Edition through 9.3 contains a missing …6.5
• CVE-2026-109204LogicalDOC Community Edition through 9.3 contains an imprope…6.3
• CVE-2026-109205LogicalDOC Community Edition through 9.3 contains an unauthe…7.5
• CVE-2026-109206LogicalDOC Community Edition through 9.3 contains a username…5.3
• CVE-2026-109207The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, N…7.2
• CVE-2026-10921Integer overflow in Dawn in Google Chrome prior to 149.0.782…8.3
• CVE-2026-10922Insufficient validation of untrusted input in DevTools in Go…8.8
• CVE-2026-109221The Groundhogg — CRM, Newsletters, and Marketing Automation …8.1
• CVE-2026-109222Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-109224The SureCart – Ecommerce Made Easy For Selling Physical Prod…7.2
• CVE-2026-109225SGLang through 0.5.21 contains an unbounded memory allocatio…7.5
• CVE-2026-109226SGLang through 0.5.21 contains a decompression amplification…7.5