# CVE-2026-75977: Mang Board WP authentication cookie forgery

Source: https://junglewise.ai/threats/cve-2026-75977-mang-board-wp-authentication-cookie-forgery  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75977 · Severity: high · CVSS 8.8 · Published 2026-08-26

Mang Board WP is a WordPress plugin that provides forum functionality. The plugin incorrectly generates authentication cookies, allowing users with basic subscriber access to forge administrator credentials and take over WordPress sites. An attacker can change admin passwords and gain full control without higher-level permissions.

## Quick answers

**Is CVE-2026-75977 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75977 being exploited in the wild.

**How severe is CVE-2026-75977?** High severity, with a CVSS score of 8.8, published 26 August 2026.

**Which products and versions are affected?** Mang Board WP Mang Board WP up to and including 2.3.7.

**Is there a fix for CVE-2026-75977?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-75977 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-75977?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication bypass via cookie forgery, stemming from flawed HMAC generation in the mbw_get_hash_key() function. When a WordPress user is logged in, the function uses the current user's identity instead of the cookie username parameter when computing the HMAC, combined with insufficient validation in mbw_validate_auth_cookie(). This allows authenticated attackers with subscriber-level or higher privileges to craft valid administrator authentication cookies. The attack requires an authenticated session but does not require user interaction; an attacker can forge cookies and escalate to full site control by changing administrator passwords.

## Affected products

- Mang Board WP Mang Board WP up to and including 2.3.7

## Timeline

- 2026-08-26: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/mangboard/tags/2.3.5/api/mb-template.php](https://plugins.trac.wordpress.org/browser/mangboard/tags/2.3.5/api/mb-template.php)
- [https://plugins.trac.wordpress.org/browser/mangboard/tags/2.3.5/includes/functions/func.board.php](https://plugins.trac.wordpress.org/browser/mangboard/tags/2.3.5/includes/functions/func.board.php)