Zero Radar
← feed
CriticalVulnerabilityCVE-2026-111834updated 25 Oct 2026, 19:06 UTC

Mang Board WP plugin lets attackers upload web shells to websites

A flaw in the Mang Board WP plugin for WordPress lets an outsider upload a hidden program to the website. That program can let them take control of the site.

Official, 2 sources
SeverityCriticalCVSS 9.9 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1AttackerSends a crafted file upload request
  2. 2Plugin uploadPlugin accepts a dangerous file type
  3. 3Web shell savedScript is stored on the web server
  4. 4Remote accessAttacker runs commands through the shell
  5. ResultAttacker controls the web server

What happened

Mang Board WP (by Kitae Park) has an unrestricted file upload vulnerability (CWE-434) that allows an attacker to upload a web shell to the web server.

Why it is dangerous: A web shell gives an attacker remote control of the server, so they can steal or change data, deface the site, or use it for further attacks. Any site running the affected plugin is at risk.

Are you affected?

You are affected if your WordPress site runs the Mang Board WP plugin, version 2.4.4 or earlier.

Mang Board WP plugin: all versions through 2.4.4

What to do

  1. Check whether the Mang Board WP plugin is installed on your site and what version it is
  2. If it is version 2.4.4 or earlier, deactivate and remove it until a fixed version is confirmed
  3. Review your upload folders for unexpected script files such as .php files

Timeline

  1. 21 Oct 2026, 15:17 UTC
    Publicly disclosed
  2. 21 Oct 2026, 15:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 19:06 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-111834 · GHSA-w892-rc7v-qpx5
CVSS
9.9 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
21 Oct 2026, 15:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 19:06 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Mang Board WP plugin lets attackers upload web shells to websites · Zero Radar