CVE-2020-35626: Mediawiki

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

An issue was discovered in the PushToWatch extension for MediaWiki through 1.35.1. The primary form did not implement an anti-CSRF token and therefore was completely vulnerable to CSRF attacks against onSkinAddFooterLinks in PushToWatch.php.

Affected products

• Mediawiki Mediawiki: up to and including 1.35.1

Published 2020-12-21. Last modified 2026-06-17.