The vulnerability lies in the Mang Board plugin’s handling of the '<mode>_type' parameter, which lacks authentication or nonce checks and can be manipulated to include a local file. An attacker can supply a value that causes the plugin to include a file containing malicious PHP code, which will then execute on the server. This gives the attacker the ability to run arbitrary code, bypass access controls, and read sensitive data stored on the site. The flaw is a classic local file inclusion expressed by CWE-98 and results in a high‑severity risk because the attacker only needs to send an unauthenticated POST request to any page that renders the public [mb_board] shortcode.

The affected vendor is kitae-park, specifically the Mang Board plugin for WordPress versions up to and including 2.4.3. The flaw applies on any WordPress installation that has this plugin installed and allows public rendering of the [mb_board] shortcode.

The vulnerability carries a CVSS score of 8.1, indicating a high severity. The EPSS score of 1% suggests that exploitation is considered unlikely on a global scale but is still nonzero. The flaw is not listed in the CISA KEV catalog, so no active exploit has been documented. Because no authentication is required and the attack vector is a simple unauthenticated POST request to a public shortcode page, the exploitation conditions are trivially satisfied. The necessary conditions for exploitation are a WordPress site with Mang Board <= 2.4.3 installed, public rendering of the [mb_board] shortcode, and a standard PHP installation that permits local file inclusion.