The UserPageViewTracker Extension of Wikimedia Foundation's Mediawiki contains a SQL Injection vulnerability (CWE-89) due to improper neutralization of special elements in SQL commands. This flaw affects versions before 1.46.1, 1.45.5, and 1.43.10, allowing potential injection of malicious SQL code. No detailed technical or exploitation information is provided, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the affected database, potentially leading to unauthorized data access or modification. However, no active exploits have been reported, and the exact impact depends on the deployment context and database privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates and consider restricting access to the affected extension if feasible.