CVE-2026-109219: CWE-434 Unrestricted Upload of File with Dangerous Type in kitae-park Mang Board

CVE-2026-109219 is an arbitrary file upload vulnerability in the Mang Board plugin for WordPress affecting all versions up to and including 2.4.4. The vulnerability arises because the mbw_file_upload function fails to validate the file extension of the attacker-controlled image_path parameter. The plugin only applies an extension allowlist to a separate file_name parameter, allowing attackers to bypass restrictions and upload files with dangerous extensions. Since the board allows guest posts by default and the required nonce is publicly exposed, unauthenticated remote attackers can upload malicious files that may lead to remote code execution.

Successful exploitation allows unauthenticated attackers to upload arbitrary files, including executable code, to the server hosting the WordPress site. This can lead to full remote code execution, compromising confidentiality, integrity, and availability of the affected system. The vulnerability has a CVSS 3.1 score of 9.8 (critical), indicating a high-impact security risk.

No official patch or fix is currently documented. Users should check the vendor's advisory for updates. Until a fix is available, it is recommended to disable guest posting on the Mang Board plugin to prevent unauthenticated uploads. Additionally, restricting file upload permissions and monitoring for suspicious files may help mitigate risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.