Critical SQL Injection Flaw Found in Mang Board WP Plugin Through Version 2.4.4

The National Vulnerability Database has published details regarding CVE-2026-109698, a critical security flaw in the Mang Board WP plugin. This vulnerability allows for SQL injection attacks, potentially compromising database integrity and confidentiality. The issue is rated with a CVSS score of 9.3, indicating severe risk to affected systems.

According to the NVD record, the flaw stems from improper neutralization of special elements used in SQL commands. This weakness is classified under CWE-89, which covers SQL injection vulnerabilities. Attackers can exploit this by injecting malicious SQL code through input fields, potentially gaining unauthorized access to database contents or modifying data without proper authorization.

Context and Background

The vulnerability exists within the Kitae Park Mang Board WP plugin, a tool used for managing manga boards on WordPress sites. The NVD description specifies that the issue allows SQL injection due to insufficient validation of user-supplied data. This type of flaw is common in web applications that interact directly with databases without adequate sanitization or parameterized queries.

The CVSS score of 9.3 reflects the high potential impact of this vulnerability. SQL injection attacks can lead to complete database compromise, including data theft, data modification, or even remote code execution in some scenarios. The severity rating underscores the urgent need for site administrators to address this issue, as it poses a significant threat to WordPress installations using this specific plugin.

Who Is Affected

The vulnerability affects all versions of the Mang Board WP plugin from its initial release through version 2.4.4. According to the NVD record, there is no earlier unaffected version mentioned, meaning any installation of the plugin up to 2.4.4 is vulnerable. Site owners using this plugin must verify their current version to determine if they are at risk.

The plugin is developed by Kitae Park, and the flaw is inherent in the codebase up to the latest documented version. Users who have not updated beyond 2.4.4 are exposed to this critical SQL injection risk. Since no patched version is mentioned in the source material, administrators should assume that all installations up to 2.4.4 remain vulnerable until further notice.

What should you do?

Site administrators should immediately audit their WordPress installations to check for the presence of the Mang Board WP plugin. If the plugin is installed, they should verify the version number against the affected range. Given the critical severity of the flaw, temporary mitigation strategies such as restricting access to vulnerable endpoints may be necessary while awaiting a vendor patch.