CVE-2025-53501: wikimedia foundation mediawiki - scribunto extension Improper Access Control
Vulnerability summary
CVE-2025-53501 is a high (CVSS 8.8) Improper Access Control vulnerability in wikimedia foundation mediawiki - scribunto extension. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.9% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 03-07-2025PublishedVulnerability first disclosed.
- 10-07-2025Last modifiedVulnerability information updated.
Description
Improper Access Control vulnerability in Wikimedia Foundation Mediawiki - Scribunto Extension allows : Accessing Functionality Not Properly Constrained by Authorization.This issue affects Mediawiki - Scribunto Extension: from 1.39.X before 1.39.12, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.38%
Chance of exploitation in the next 30 days
Percentile
31%
Versus all other CVEs
30-day change
+0.05 pp
From 0.34% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (phabricator.wikimedia.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Wikimedia foundation1 product
- mediawiki - scribunto extension≥ 1.39.x, < 1.39.13 | ≥ 1.42.x, < 1.42.7 | ≥ 1.43.x, < 1.43.2
Xtex1 product
2 vendors · 2 products