Mang Board <= 2.4.3 - Unauthenticated Local File Inclusion via '<mode>_type' Parameter

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-104909 · Microsoft / collected KEV context

cve-program · CVE-2026-104909

• https://www.wordfence.com/threat-intel/vulnerabilities/id/cbf1cbe0-4740-4d76-a3f5-7d2e1a64d4ee?source=cve
• https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/includes/class.board.php#L175
• https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/includes/class.store.php#L124
• https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/includes/functions/func.board.php#L360
• https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.3/mangboard.php#L181
• https://wordpress.org/plugins/mangboard/
• https://plugins.trac.wordpress.org/changeset/3738898/mangboard/trunk/includes/functions/func.board.php

No related operational record is retained in the current change model.