Critical severity · published Oct 15, 2026
CVE-2026-109698
WordPress Mang Board WP plugin <= 2.4.4 - SQL Injection vulnerability
9.3
CVSS
0.3%
EPSS
No
On KEV
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kitae Park Mang Board WP mangboard allows SQL Injection.This issue affects Mang Board WP: from n/a through 2.4.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MB
Mang Board WP · Kitae Park
through 2.4.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-109698
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-109698
patchstack.com
https://patchstack.com/database/wordpress/plugin/mangboard/vulnerability/wordpress-mang-board-wp-plugin-2-4-4-sql-injection-vulnerability?_s_id=cve
More from Mang Board WP
9.9
CVE-2026-111834
WordPress Mang Board WP plugin <= 2.4.4 - Arbitrary File Upload vulnerability
8.8
CVE-2026-84770
WordPress Mang Board WP plugin <= 2.3.8 - Cross Site Request Forgery (CSRF) vulnerability
8.8
CVE-2026-75977
Mang Board WP <= 2.3.7 - Authenticated (Subscriber+) Privilege Escalation to Forged Authentication Cookie
7.1
CVE-2026-94176
WordPress Mang Board WP plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability
7.1
CVE-2026-61974
WordPress Mang Board WP plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability