WordPress Mang Board WP plugin <= 2.4.4 - SQL Injection vulnerability

mangboard · SQL injection · CWE-89

Affectedmangboard

FixUpdate to 2.4.5 or newer

PublishedOct 15, 12:09 · Patchstack

ScoredOct 15 · 9.3 · Patchstack

Exploit code publicNone known · checked 21:18 UTC

ExploitedNone known · CISA KEV checked 22:11 UTC

What we know

No known exploitation. CISA KEV, checked 22:11 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.

An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.

A successful attack can read data. CVSS impact.

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kitae Park Mang Board WP mangboard allows SQL Injection.This issue affects Mang Board WP: from n/a through 2.4.4.

From Patchstack

Affected and fixed versions

ProductAffectedFixed inmangboardearlier versions2.4.5

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

patchstack.com/database/wordpress/plugin/mangboard/vulnerability/wordpress-mang-board-wp-plugin-2-4-4-sql-injection-vulnerability?_s_id=cve · patchstack.comvdb entry

Other CVEs in mangboard

All 6 →

7.1WordPress Mang Board WP plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability · CVE-2026-116847Oct 30 9.9WordPress Mang Board WP plugin <= 2.4.4 - Arbitrary File Upload vulnerability · CVE-2026-111834Oct 21 7.1WordPress Mang Board WP plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability · CVE-2026-94176Sep 23