WordPress Mang Board Plugin Arbitrary File Upload Vulnerability

The Mang Board plugin for WordPress is vulnerable to an Arbitrary File Upload in all versions up to and including 2.4.4. The flaw exists in the mbw_file_upload function.

The plugin fails to validate the file extension on the attacker-supplied image_path parameter. The basename-derived file name bypasses the extension allowlist that is applied only to the separate file_name parameter.

This allows unauthenticated attackers to upload potentially executable files, leading to remote code execution. Exploitation requires:

• The board to be configured to allow guest posts, which is the plugin's default mode.
• The required nonce, which is printed on every public board page and readable by any unauthenticated visitor without a WordPress login.