What’s Vulnerable › Vulnerabilities

CVE-2026-102796: Unauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parameters

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-29 · updated 2026-10-01
• Weakness: CWE-89

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wikimedia Foundation Mediawiki - UserPageViewTracker Extension allows SQL Injection. This issue affects Mediawiki - UserPageViewTracker Extension: from * before 1.46.1, 1.45.5, 1.43.10.

Affected products

• Wikimedia Foundation Mediawiki - UserPageViewTracker Extension: before 1.46.1, 1.45.5, 1.43.10 — fixed in 1.43.10, 1.45.5, 1.46.1

How to fix

Upgrade to a fixed version: Wikimedia Foundation Mediawiki - UserPageViewTracker Extension 1.43.10, 1.45.5, 1.46.1. Check the vendor advisory for mitigations.

References

• https://gerrit.wikimedia.org/r/q/I43c5360c2f78611351b5dc4c90a80e627d51deaf
• https://phabricator.wikimedia.org/T432836
• https://phabricator.wikimedia.org/T432836

Get alerted when CVE-2026-102796 or the next vulnerability affects your stack