CVE-2026-75977: CWE-269 Improper Privilege Management in kitae-park Mang Board WP

The Mang Board WP plugin for WordPress suffers from a Missing Authorization vulnerability stemming from improper privilege management (CWE-269). The flaw lies in the mbw_get_hash_key() function, which incorrectly generates HMACs using the current logged-in user's identity rather than the cookie username parameter. Additionally, mbw_validate_auth_cookie() does not sufficiently validate these cookies. Together, these issues enable authenticated attackers with subscriber-level privileges or higher to forge administrator authentication cookies and reset administrator passwords, resulting in full site compromise. This affects all versions up to and including 2.3.7.

An attacker with at least subscriber-level access can escalate privileges to administrator by forging authentication cookies, allowing them to change administrator passwords and gain complete control over the WordPress site. This compromises confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user privileges carefully and monitor for suspicious activity involving authentication cookies. Avoid granting subscriber-level or higher access to untrusted users.