{"id":"CVE-2026-111834","kind":"vulnerability","aliases":["CVE-2026-111834"],"related":[],"title":"WordPress Mang Board WP: unrestricted upload lets attackers plant web shells","description":"Unrestricted Upload of File with Dangerous Type vulnerability in Kitae Park Mang Board WP mangboard allows Upload a Web Shell to a Web Server.This issue affects Mang Board WP: from n/a through 2.4.4.","summary":"Mang Board WP, a WordPress board plugin by Kitae Park, accepts uploaded files of dangerous types without checking them. An attacker can upload a web shell to the server and run commands through it.","severity":"critical","cvss":9.9,"epss":0.00372,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"Check the installed plugin version in the WordPress admin plugins list or wp-content/plugins/mangboard, and look for uploaded .php files in upload directories.","fix":"Update Mang Board WP to a version later than 2.4.4 if one is available; otherwise remove the plugin. unknown for a patched version number.","status":"open","published_at":"2026-10-21T15:17:15+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-23T22:33:15+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T22:33:15Z","model":"claude-haiku-5-5","output":{"fix":"Update Mang Board WP to a version later than 2.4.4 if one is available; otherwise remove the plugin. unknown for a patched version number.","reach":"internet","title":"WordPress Mang Board WP: unrestricted upload lets attackers plant web shells","impact":"high","summary":"Mang Board WP, a WordPress board plugin by Kitae Park, accepts uploaded files of dangerous types without checking them. An attacker can upload a web shell to the server and run commands through it.","category":"package","who_cares":["wordpress","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker runs commands on the web server via an uploaded web shell","analyst_note":"Confirm the fixed version and whether the upload needs a logged-in account, using the NVD entry and the plugin's changelog.","how_to_check":"Check the installed plugin version in the WordPress admin plugins list or wp-content/plugins/mangboard, and look for uploaded .php files in upload directories.","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.0005,"input_tokens":2919,"output_tokens":417,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-111834':14A,17A '-2026':13A,16A '2.4.4':87C 'accept':33B 'affect':80C 'allow':70C 'attack':8A,43B 'board':3A,24B,28B,67C,82C 'check':40B 'command':54B 'cve':12A,15A 'danger':37B,60C 'file':35B,58C 'host':21B 'issu':79C 'kita':31B,64C 'let':7A 'mang':2A,23B,66C,81C 'mangboard':69C 'n/a':85C 'packag':18B 'park':32B,65C 'plant':9A 'plugin':29B 'run':53B 'self':20B 'self-host':19B 'server':51B 'server.this':78C 'shell':11A,48B,74C 'type':38B,61C 'unrestrict':5A,55C 'upload':6A,34B,45B,56C,71C 'vulner':62C 'web':10A,47B,73C,77C 'without':39B 'wordpress':1A,22B,27B 'wp':4A,25B,68C,83C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T15:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111834","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111834","severity":null,"published_at":"2026-10-21T15:17:15+00:00","modified_at":"2026-10-21T18:19:16+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-111834","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111834","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}