Description
An issue was discovered in the Translate extension in MediaWiki through 1.36. The Aggregategroups Action API module does not validate the parameter for aggregategroup when action=remove is set, thus allowing users with the translate-manage right to silently delete various groups' metadata.
Remediation
References
Related Vulnerabilities
MySQL CVE-2017-3634 Vulnerability (CVE-2017-3634)
WordPress Plugin Chat-Support Board-WordPress Chat Multiple SQL Injection Vulnerabilities (3.3.3)
WordPress 4.9.x Denial of Service Vulnerability (4.9 - 4.9.4)
WordPress Plugin Justified Gallery Cross-Site Scripting (1.7.0)
WordPress Plugin WP e-Commerce-Store Toolkit Privilege Escalation (2.0.1)