All vulnerabilities
CVE-2026-102796

Unauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parameters

Wikimedia Foundation Mediawiki - UserPageViewTracker ExtensionApplications & CMS
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 1 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.25%Chance of exploitation activity in the next 30 days, higher than 15% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.46.1, 1.45.5, 1.43.10Fixed versionCVE List
Published29 Sep 2026Updated 1 Oct 2026CVE List

What fixes it

  • 1.46.1, 1.45.5, 1.43.10Mediawiki - UserPageViewTracker ExtensionCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wikimedia Foundation Mediawiki - UserPageViewTracker Extension allows SQL Injection.

This issue affects Mediawiki - UserPageViewTracker Extension: from * before 1.46.1, 1.45.5, 1.43.10.

Text from CVE List

Affected versions 1

  • Mediawiki - UserPageViewTracker Extensionaffected: * before 1.46.1, 1.45.5, 1.43.10CVE List

References 2