The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.4 via the mbw_file_upload function. This is due to missing file extension validati…
Critical CVSS 9.8
Summary
The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.4 via the mbw_file_upload function. This is due to missing file extension validation on the attacker-supplied image_path parameter, whose basename-derived file name bypasses the extension allowlist applied only to the separate file_name parameter. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possibl…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/api/mb-board.php#L428
- https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L902
- https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L903
- https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L972
- https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/mb-actions.php#L520
- https://plugins.trac.wordpress.org/changeset/3743247/mangboard/trunk/includes/functions/func.api.php
- https://wordpress.org/plugins/mangboard/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/1e4f4860-b4c9-4f41-b1d0-0b2da8c88b99?source=cve
Timeline
- nvd_ingest NVD