CVE-2026-104909: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in kitae-park Mang Board

CVE-2026-104909 describes a Local File Inclusion vulnerability in the Mang Board plugin for WordPress, affecting all versions up to and including 2.4.3. The flaw exists in the handling of the '<mode>_type' parameter, which is used in include/require statements without proper validation, allowing attackers to include arbitrary PHP files. The attack vector is an unauthenticated POST request to pages rendering the [mb_board] shortcode, which lacks nonce or capability checks. On standard PHP installations, the attacker can leverage pearcmd.php to write and include a malicious payload in a single request, enabling remote code execution. The CVSS 3.1 score is 8.1 (High), reflecting network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required.

Successful exploitation allows unauthenticated attackers to execute arbitrary PHP code on the server, potentially bypassing access controls and accessing sensitive data. This can lead to full system compromise, including code execution, data disclosure, and denial of service. The vulnerability is exploitable remotely over the network without authentication.

No official patch or remediation is currently documented for this vulnerability. Users should monitor the vendor's advisory channels for updates. As a temporary mitigation, restrict access to pages rendering the [mb_board] shortcode or disable the plugin until a fix is available. Implementing web application firewall (WAF) rules to block suspicious POST requests targeting the vulnerable parameter may reduce risk. Avoid uploading or allowing PHP files that could be included by the plugin.