The Mang Board WordPress plugin contains an arbitrary file upload flaw caused by missing file extension validation on the image_path parameter. This flaw allows an unauthenticated attacker to submit a file that bypasses the extension allowlist applied to the file_name field. Once uploaded, a file that can contain executable code, such as a PHP script, can be stored on the server and later executed, resulting in remote code execution. The weakness corresponds to CWE‑434, the unrestricted upload of a dangerous file type.

WordPress installations running Mang Board version 2.4.4 are vulnerable. The plugin’s default configuration permits guest posts, exposing the upload endpoint to unauthenticated users unless the administrator disables this feature.

The issue carries a CVSS score of 9.8, indicating critical severity, while the EPSS score of < 1 % reflects a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker can leverage the public nonce that the plugin prints on every board page to craft a valid upload request, meaning that unauthenticated access, guest posting, and file upload parameters together enable the exploitation of this flaw.