The MediaWiki CentralAuth extension versions 1.43, 1.45, and 1.46 contain a CWE-15 vulnerability that allows external control of system or configuration settings, resulting in potential code injection. The CVSS 4.0 score is 7.2, indicating a high severity. The attack vector is network-based but requires high attack complexity, privileges, and user interaction. The vulnerability impacts confidentiality, integrity, and availability with high scope impact. No vendor advisory or patch information is provided.

Successful exploitation could allow an attacker with high privileges and user interaction to inject code via external control of system or configuration settings in the CentralAuth extension. This can compromise system confidentiality, integrity, and availability. However, exploitation requires complex conditions and elevated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, administrators should monitor for updates from The Wikimedia Foundation and apply any official fixes once available. Until then, restrict access to high-privilege accounts and limit user interactions that could trigger this vulnerability.