CVE WATCH / VULNERABILITY DETAIL
CVE-2026-109219
CRITICALCVSS 9.8NVD feed
Published 16 October 2026 · tracked since 17 October 2026
Description
The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.4 via the mbw_file_upload function. This is due to missing file extension validation on the attacker-supplied image_path parameter, whose basename-derived file name bypasses the exten
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-63618 HIGH 7.5
- CVE-2026-111391 HIGH 8.1
- CVE-2026-92766 HIGH 7.5
- CVE-2026-111311 HIGH 8.8
- CVE-2026-75903 HIGH 8.1
- CVE-2026-92553 HIGH 8.8
- CVE-2026-97296 HIGH 8.1
- CVE-2026-92115 HIGH 8.8
- CVE-2026-110015 HIGH 8.8
- CVE-2026-110135 HIGH 7.4