CSRF Vulnerability in MediaWiki SecurePoll Extension

CVE-2025-53483

What is CVE-2025-53483?

The SecurePoll extension in MediaWiki contains a vulnerability where critical functions in ArchivePage.php, UnarchivePage.php, and VoterEligibilityPage#executeClear() fail to properly validate request methods and CSRF tokens. This oversight allows an attacker to perform privileged actions if an administrator is lured to a malicious site, potentially compromising the integrity of sensitive operations and data within the application. Prompt attention to securing these endpoints is necessary to mitigate the risk of unauthorized actions.

References