The vulnerability arises from the WikiLambda Extension’s handling of revision deletions, allowing attackers to view deleted pages through specific URLs such as action=edit and Special:ViewAbstract. This permits an unauthorized actor to access sensitive information that should have been removed, posing a moderate risk because it does not directly allow code execution or denial of service, but it does expose confidential content. The weakness is documented as CWE‑200, which indicates information disclosure due to insufficient access controls.

This flaw affects the Mediawiki WikiLambda Extension version 1.47.0‑alpha used by installations of the Wikimedia Foundation. No other product versions are listed in the CNA data, and the fix has already been applied to the 'master' branch of the extension. Existing installations that have not yet upgraded remain vulnerable.

The CVSS score of 6.9 signals a moderate severity. Because the EPSS score is not publicly available, the current likelihood of exploitation is unknown, but the vulnerability is not present in CISA's KEV catalog. Attackers can likely exploit the flaw by making HTTP requests to the exposed URLs; this does not require elevated privileges beyond access to the web application, so the attack vector can be inferred as 'remote unauthenticated request'. Until an updated version is installed, the risk remains that intercepted or improperly authorized users could retrieve deleted revisions.