This vulnerability (CVE-2026-14363) involves improper neutralization of special elements used in SQL commands within the Mediawiki Cargo Extension, leading to an SQL injection risk. It affects all versions before 1.43.9, 1.44.6, and 1.45.4. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, low privileges required, and no user interaction needed. The Wikimedia Foundation has published the vulnerability but has not yet provided an official fix or remediation level. No known exploits have been reported.

Successful exploitation could allow an unauthenticated attacker to inject malicious SQL commands, potentially leading to unauthorized data access or modification within the Cargo Extension's database. The impact is rated medium severity based on the CVSS score of 6.9. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the Wikimedia Foundation's official advisory for current remediation guidance. Until a fix is available, users should monitor official channels for updates and consider limiting exposure of the vulnerable extension if possible.