CVE-2026-109219: Arbitrary File Upload in Mang Board Plugin for WordPress

The Mang Board plugin for WordPress, in all versions up to and including 2.4.4, contains a critical arbitrary file upload vulnerability within the mbw_file_upload function. The vulnerability arises because the function fails to perform adequate file extension validation on the attacker-controlled image_path parameter. While a separate file_name parameter is subject to an allowlist, the logic incorrectly utilizes the basename of the image_path to determine the final filename, effectively bypassing existing security controls.

Because the required nonce for the upload action is printed on public-facing board pages, unauthenticated attackers can scrape this token and proceed with the upload process. When the plugin is configured for guest posts, which is the default setting, remote attackers can upload executable files (such as PHP webshells) to the server. Successful exploitation enables unauthenticated remote code execution, granting attackers full control over the affected WordPress installation. Organizations should prioritize updating the plugin to a patched version once available and ensuring guest post configurations are restricted where possible.