PT-2025-28018 · Mediawiki · Mediawiki Securepoll Extension

Published 2025-07-04 · Updated 2025-07-04 · CVE-2025-53485

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: MediaWiki SecurePoll extension versions 1.39.X through 1.39.12 MediaWiki SecurePoll extension versions 1.42.X through 1.42.6 MediaWiki SecurePoll extension versions 1.43.X through 1.43.1

Description: The issue arises from the lack of validation in SetTranslationHandler.php, which fails to check if a user is an election admin before allowing changes to election-related translation text. This oversight enables any user, including unauthenticated ones, to modify these translations. Although the check is partially broken in newer MediaWiki versions, it remains missing.

Recommendations: For MediaWiki SecurePoll extension versions 1.39.X through 1.39.12, update to version 1.39.13 or later. For MediaWiki SecurePoll extension versions 1.42.X through 1.42.6, update to version 1.42.7 or later. For MediaWiki SecurePoll extension versions 1.43.X through 1.43.1, update to version 1.43.2 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-53485

Affected Products

Mediawiki Securepoll Extension

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-53485 · Security Note
• https://gerrit.wikimedia.org/r/149668 · Note
• https://twitter.com/CVEnew/status/1941193290801610947 · Twitter Post
• https://phabricator.wikimedia.org/T392341 · Note
• https://t.me/cvenotify/127731 · Telegram Post