CVE-2026-109698: WordPress Mang Board WP plugin <= 2.4.4 - SQL Injection vulnerability

Deferred

Published 15-10-2026Last modified 15-10-2026

Vulnerability summary

CVE-2026-109698 is a critical (CVSS 9.3) SQL Injection vulnerability in kitae park mang board wp. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20.5% of scored vulnerabilities.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.3/10

010

Critical · v3.1 (CVE.org)

EPSS score

0.29%

0%100%

Low · Change unavailable

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

15-10-2026
PublishedVulnerability first disclosed.
15-10-2026
Last modifiedVulnerability information updated.

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kitae Park Mang Board WP mangboard allows SQL Injection.This issue affects Mang Board WP: from n/a through 2.4.4.

CVSS metrics

2 scores · 2 sources · 1 version

v3.19.3

EPSS trend

Probability

0.29%

Chance of exploitation in the next 30 days

Percentile

21%

Versus all other CVEs

30-day change

Change unavailable

16-10-202622-10-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Affected systems

Kitae park1 product

mang board wp≤ 2.4.4

1 vendor · 1 product

References

1 links

patchstack.com/database/…VDB Entry