The Mang Board WP plugin admits any file type to be uploaded without proper validation. An attacker can place a PHP web shell on the server, enabling unrestricted execution of commands and full compromise of the site. The weakness is a classic arbitrary file upload flaw listed as CWE-434.

Kitae Park Mang Board WP plugin versions up to and including 2.4.4 are affected. The vulnerability exists in all releases from the earliest version through 2.4.4.

The CVSS score of 9.9 signals critical severity. EPSS is not provided, and the vulnerability is not in the CISA KEV catalog. Although no public exploit is confirmed, the nature of the flaw permits remote exploitation via the plugin’s upload interface; a successful upload of a malicious file with a dangerous type would give an attacker direct code execution on the web server.