The vulnerability is an external control of a configuration setting within the MediaWiki CentralAuth extension. When an attacker substitutes a session key, the system processes the value incorrectly, resulting in PHP object injection that can execute arbitrary code. This reflects CWE‑15, where attackers influence system configuration or behavior

Vulnerable versions of the Wikimedia Foundation’s MediaWiki CentralAuth extension—1.46, 1.45, and 1.43—are impacted. The flaw exists in how session-key substitution is handled during account merging operations

The CVSS score of 7.2 classifies the issue as high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Despite that, the flaw permits remote code injection with a potentially high incentive for attackers. If an attacker can control session data, they could inject malicious objects and achieve full code execution on the server