# CVE-2026-109219: Mang Board plugin arbitrary file upload in file handling

Source: https://junglewise.ai/threats/cve-2026-109219-the-mang-board-plugin-for-wordpress-is-vulnerable-to-arbitrary  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109219 · Severity: critical · CVSS 9.8 · Published 2026-10-16

The Mang Board plugin for WordPress allows unauthenticated attackers to upload arbitrary files, including executable code, because it fails to properly validate file extensions. Since the plugin permits guest posts by default and displays the required security token on public pages, an attacker can remotely execute code on the web server without needing a WordPress account.

Vendors: [Automatic](https://junglewise.ai/threats/vendors/automatic).

## Quick answers

**Is CVE-2026-109219 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109219 being exploited in the wild.

**How severe is CVE-2026-109219?** Critical severity, with a CVSS score of 9.8, published 16 October 2026.

**Which products and versions are affected?** Automatic Mang Board up to and including 2.4.4.

**Is there a fix for CVE-2026-109219?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-109219 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-109219?** Check whether you run Automatic Mang Board at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The mbw_file_upload function validates the file_name parameter against an extension allowlist but fails to validate the image_path parameter, allowing an attacker to bypass restrictions via basename manipulation. An unauthenticated attacker can craft a request with a malicious image_path to upload executable files; this requires guest posts to be enabled (default) and the attacker to obtain a nonce from any public board page. Successful exploitation results in arbitrary code execution on the server.

## Affected products

- Automatic Mang Board up to and including 2.4.4

## Timeline

- 2026-10-16: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/api/mb-board.php](https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/api/mb-board.php)
- [https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php](https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php)