CVE-2026-104909: Mang Board WordPress Plugin RCE Vulnerability

CVE-2026-104909 Overview

The Mang Board plugin for WordPress contains a Local File Inclusion (LFI) vulnerability affecting all versions up to and including 2.4.3. The flaw resides in the <mode>_type parameter handling within the plugin's shortcode render path. Unauthenticated attackers can include and execute arbitrary .php files on the server by submitting a crafted POST request to any page rendering the public [mb_board] shortcode. Because no nonce or capability check guards the shortcode render path, exploitation requires no authentication. On servers with standard PHP installations, attackers can abuse pearcmd.php to write and include an attacker-controlled payload file in a single request, achieving remote code execution.

Critical Impact
Unauthenticated attackers can execute arbitrary PHP code on affected WordPress servers, enabling full site compromise, data theft, and lateral movement.

Affected Products

Mang Board WordPress Plugin versions ≤ 2.4.3
WordPress installations rendering the [mb_board] shortcode on public pages
PHP environments with pearcmd.php available in the include path

Discovery Timeline

2026-10-14 - CVE-2026-104909 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-104909

Vulnerability Analysis

The vulnerability is classified as Local File Inclusion [CWE-98], Improper Control of Filename for Include/Require Statement in PHP Program. The Mang Board plugin accepts user-controlled input through parameters following the <mode>_type naming convention (for example, foo_type) and passes those values into PHP include or require statements without sufficient validation. Attackers can direct the plugin to load arbitrary .php files from the local filesystem, causing their contents to execute within the WordPress process context.

Exploitation is trivial because the shortcode render path lacks both nonce verification and capability checks. Any public page containing the [mb_board] shortcode becomes an attack surface reachable by anonymous users. Review the plugin source at the WordPress Plugin Code Reference for the vulnerable render path.

Root Cause

The root cause is the direct use of unsanitized request parameters in file inclusion calls. The plugin trusts the <mode>_type parameter to resolve template or handler file paths without enforcing an allowlist, canonicalizing the path, or restricting inclusion to a safe directory. The absence of nonce and capability checks on the shortcode render path removes the only remaining barriers to unauthenticated exploitation.

Attack Vector

An attacker sends an unauthenticated POST request to any WordPress page that renders the [mb_board] shortcode. The POST body includes a <mode>_type parameter whose value resolves to a local .php file. On standard PHP installations with PEAR, the attacker references pearcmd.php to write an attacker-controlled file to a predictable location, then references that file through the same inclusion sink to execute arbitrary PHP in a single request chain.

See the Wordfence Vulnerability Analysis for additional technical context. No verified proof-of-concept code is provided in the public references.

Detection Methods for CVE-2026-104909

Indicators of Compromise

POST requests to WordPress pages containing parameters matching the pattern *_type with values referencing .php files or path traversal sequences such as ../.
Access log entries referencing pearcmd.php, /tmp/, or other unexpected paths within request bodies targeting pages rendering [mb_board].
Unexpected .php files appearing in web-accessible directories, uploads folders, or temporary directories after Mang Board requests.
Outbound network connections from the PHP worker process to attacker-controlled infrastructure immediately following shortcode requests.

Detection Strategies

Audit web server logs for POST requests to pages containing the [mb_board] shortcode and inspect any *_type parameters for file paths.
Monitor PHP error logs for include() and require() warnings referencing unexpected file paths originating from the Mang Board plugin.
Deploy web application firewall rules that block parameters matching _type suffixes when their values contain .., /, or .php substrings.

Monitoring Recommendations

Enable file integrity monitoring on the WordPress installation directory to flag newly written .php files.
Correlate HTTP request telemetry with process execution events on the web server to identify PHP processes spawning shells, downloaders, or outbound connections.
Track WordPress plugin inventory to confirm installed versions against the fixed release.

How to Mitigate CVE-2026-104909

Immediate Actions Required

Update the Mang Board plugin to the patched release referenced in the WordPress Changeset Update.
Audit all public pages for use of the [mb_board] shortcode and temporarily remove it where business impact permits until patching is complete.
Review web server and WordPress logs for the indicators listed above and investigate any matching requests as potential compromise.

Patch Information

The plugin maintainers published a fix in changeset 3738898. Site operators should upgrade to the latest version available on the WordPress Mangboard Plugin Page and verify the installed version is greater than 2.4.3. After patching, rotate WordPress administrator credentials, API keys, and database passwords if evidence of exploitation exists.

Workarounds

Remove the [mb_board] shortcode from all public pages until the plugin is updated.
Deploy WAF rules that reject requests containing *_type parameters with values matching .php extensions, path separators, or pearcmd references.
Disable or remove pearcmd.php from the PHP include path on servers where PEAR is not required.
Restrict PHP open_basedir and allow_url_include directives to limit the filesystem scope available to included files.

bash

# Example php.ini hardening
allow_url_include = Off
open_basedir = "/var/www/html:/tmp"
# Remove pearcmd.php if PEAR is not required
rm /usr/share/php/pearcmd.php