The vulnerability is an unauthenticated SQL injection in the UserPageViewTracker extension of MediaWiki. Attackers can manipulate the filterusers and ignoreusers query parameters to inject arbitrary SQL code into backend queries, which can lead to extraction or modification of database contents. This flaw exposes sensitive data and can compromise the integrity of the system.

The flaw impacts versions of the MediaWiki UserPageViewTracker extension that are earlier than 1.46.1, including 1.45.5 and 1.43.10, when distributed by the Wikimedia Foundation. Administrators running these legacy extensions are at risk.

The CVSS score of 7.5 indicates a high severity risk, while the EPSS score of less than 1% suggests that exploitation is currently rare but not impossible. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the unauthenticated injection via simple web requests to the filterusers and ignoreusers parameters, making technical exploitation straightforward. The lack of countermeasures in the code means the overall risk remains high for publicly exposed applications.