# CVE-2026-84770: Mang Board WP unauthenticated CSRF

Source: https://junglewise.ai/threats/cve-2026-84770-mang-board-wp-unauthenticated-csrf  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-84770 · Severity: high · CVSS 8.8 · Published 2026-09-02

Mang Board WP is a WordPress plugin used to create discussion boards and community forums on WordPress sites. An unauthenticated attacker can trick a logged-in site administrator or user into performing unintended actions (such as changing settings, deleting content, or modifying accounts) by crafting a malicious webpage or link. This could lead to unauthorized modifications, account compromise, or site disruption depending on the victim's privilege level.

## Quick answers

**Is CVE-2026-84770 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84770 being exploited in the wild.

**How severe is CVE-2026-84770?** High severity, with a CVSS score of 8.8, published 2 September 2026.

**Which products and versions are affected?** Mang Board Mang Board WP <=2.3.8.

**Is there a fix for CVE-2026-84770?** A patch was published on 2026-09-02: Fixed in version 2.3.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84770 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-84770?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a Cross-Site Request Forgery (CSRF) flaw in the Mang Board WP plugin versions up to and including 2.3.8. CSRF attacks exploit the trust a web application places in an authenticated user's browser by forcing the browser to make unwanted requests to the vulnerable application without the user's knowledge. The vulnerability does not require authentication to craft the malicious request, but successful exploitation requires a victim who is already logged in to the WordPress site and who visits or interacts with the attacker's crafted content. An attacker can achieve various impacts depending on the actions available through the vulnerable endpoints, ranging from data manipulation to administrative account compromise. The vulnerability has been patched in version 2.3.9 and later.

## Affected products

- Mang Board Mang Board WP <=2.3.8

## Timeline

- 2026-08-25: disclosed: Vulnerability reported by John Ryan Albon
- 2026-09-02: advisory: Published by Patchstack
- 2026-09-02: patched: Fixed in version 2.3.9

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/mangboard/vulnerability/wordpress-mang-board-wp-plugin-2-3-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/mangboard/vulnerability/wordpress-mang-board-wp-plugin-2-3-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve)