Description
An issue was discovered in SubmitEntityAction in Wikibase in MediaWiki through 1.39.3. Because it doesn't use EditEntity for undo and restore, the intended interaction with AbuseFilter does not occur.
Remediation
References
Related Vulnerabilities
WordPress Plugin Ultimate Membership Pro Cross-Site Request Forgery (8.6.1)
WordPress Plugin N-Media Website Contact Form with File Upload Arbitrary File Upload (1.3.4)
Ruby Improper Input Validation Vulnerability (CVE-2008-3657)
SharePoint Heap-based Buffer Overflow Vulnerability (CVE-2026-45475)
WordPress Plugin Custom CSS Pro Cross-Site Request Forgery (1.0.3)