MediaWiki UserPageViewTracker CVE-2026-102796

Requires a MediaWiki installation with the third-party UserPageViewTracker extension installed and enabled at a vulnerable version (any version before 1.46.1, 1.45.5, or 1.43.10) - this extension is optional and not present in default MediaWiki deployments, which is the primary factor limiting real-world exposure. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is needed, so any network-reachable wiki running the affected extension is exploitable by anonymous attackers. Impact is limited to confidentiality (database read/exfiltration); the vector asserts no integrity or availability impact.

Signals point to a genuine but moderate-priority web vulnerability rather than an urgent crisis. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remote, low-complexity, unauthenticated SQL injection, and the 7.5 score is driven entirely by confidentiality (C:H/I:N/A:N) - consistent with data exfiltration from the backing database rather than full compromise. The SSVC framework reinforces concern on two axes: Automatable:yes (reconnaissance and exploitation can be scripted) and Technical Impact:partial. However, EPSS is very low at 0.16% (5th percentile), and the vulnerability is NOT on CISA KEV, so there is no evidence of real-world exploitation despite the automatable, unauthenticated profile. The tension is between high theoretical exploitability (easy, remote, scripted) and low observed/predicted activity - best explained by narrow deployment: UserPageViewTracker is an optional MediaWiki extension, not core software, so the attack surface is small. SSVC notes a proof-of-concept exists, which raises the practical risk above a purely theoretical finding. Net: patch promptly where the extension is in use, but this is not a mass-exploitation emergency.

A remote, unauthenticated attacker identifies a MediaWiki site running the UserPageViewTracker extension and submits a crafted request containing malicious SQL in a tracked parameter. Because the input is improperly neutralized, the injected clause executes against the wiki database, letting the attacker read sensitive data such as user records or session-related information. A proof-of-concept is reported (SSVC: poc) and the low attack complexity makes exploitation straightforward and scriptable.