CVE-2026-104909

{
  "etk_id": "ETK-2026-1676",
  "cve_id": "CVE-2026-104909",
  "display_id": "CVE-2026-104909",
  "ghsa_id": "GHSA-46h5-mprp-vjcc",
  "euvd_id": "EUVD-2026-100913",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated local file inclusion in Mang Board",
  "summary": "Mang Board for WordPress versions through 2.4.3 are affected by a local file inclusion flaw. An unauthenticated remote attacker may cause server-side PHP files to be included and executed when a public page renders the plugin's board shortcode.",
  "mitigation": "Disable the Mang Board plugin or remove public access to pages that render its board shortcode until an updated release is available. Restrict PHP file uploads and review the site for unexpected PHP files.",
  "vendor": "kitae-park",
  "product": "Mang Board",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 2.4.3"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Mang Board",
      "purl": null
    }
  ],
  "cwes": [
    98
  ],
  "cvss_score": 8.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0101,
  "epss_percentile": 0.6247,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 45.91796623333333,
  "t0_at": "2026-10-14T07:43:36.462000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-18T01:32:50.302131+00:00",
      "days": 3.7425212978125,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T07:43:36.462000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-14T07:43:36.462000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T07:43:36.462000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104909"
    }
  }
}