CVE-2026-104909 Mang Board <= 2.4.3 - Unauthenticated Local File Inclusion via '<mode>_type' Parameter
Unauthenticated attackers can achieve remote code execution via local file inclusion in the Mang Board WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-104909?
CVE-2026-104909 is a high-severity path traversal vulnerability in kitae-park Mang Board, published on 14 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the '<mode>_type (e.g. foo_type)' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation is trivial via an unauthenticated POST to any page rendering a public [mb_board] shortcode, as no nonce or capability check is enforced on the shortcode render path; on servers with a standard PHP installation, pearcmd.php can be leveraged to write and then include an attacker-controlled payload file in a single request.
Weakness: CWE-98
Which versions are affected by CVE-2026-104909?
How do I fix CVE-2026-104909?
No fix has been published for CVE-2026-104909 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-104909 being exploited?
There is no known exploitation of CVE-2026-104909 in the wild and no public exploit code.
Sources
Also known as GHSA-46h5-mprp-vjcc.