An attacker can exploit an unsafe deserialization routine in MediaWiki’s WikiImporter and log entry components, allowing execution of arbitrary PHP code. The flaw is a classic “deserialize untrusted data” weakness (CWE-502) that can also lead to evaluation of malicious code (CWE-94).

All MediaWiki installations from the Wikimedia Foundation that are older than release 1.46.0 – specifically the 1.45.4, 1.44.6, and 1.43.9 releases – are affected. The vulnerability resides in includes/Import/WikiImporter.php, includes/Import/WikiRevision.php, and includes/Logging/LogEntryBase.php.

With a CVSS score of 5.9 the vulnerability is considered moderate severity, and the EPSS score of <1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, suggesting it is either low or emerging. Based on the description, it is inferred that an attacker would need to supply a crafted import payload that is deserialized by the system, typically requiring unauthorized write access to an import or log entry endpoint. No publicly documented exploits are known, but the inherent RCE nature makes it a high‑value target once the import path can be accessed.