CVE-2025-53483: SecurePoll: Multiple admin actions vulnerable to Cross-Site Request Forgery
ArchivePage.php, UnarchivePage.php, and VoterEligibilityPage#executeClear() do not validate request methods or CSRF tokens, allowing attackers to trigger sensitive actions if an admin visits a malicious site.
This issue affects Mediawiki - SecurePoll extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-53483?
CVE-2025-53483 is rated as a high severity vulnerability due to its ability to allow attackers to trigger sensitive actions through CSRF attacks.
How do I fix CVE-2025-53483?
To fix CVE-2025-53483, update the MediaWiki SecurePoll extension to a version greater than 1.39.13, greater than 1.42.7, or greater than 1.43.2.
What versions of MediaWiki SecurePoll are affected by CVE-2025-53483?
CVE-2025-53483 affects MediaWiki SecurePoll versions from 1.39.0 to 1.39.13, 1.42.0 to 1.42.7, and 1.43.0 to 1.43.2.
What does CVE-2025-53483 exploit?
CVE-2025-53483 exploits a lack of request method validation and CSRF token validation in specific PHP scripts.
Who is at risk for CVE-2025-53483?
Admins of MediaWiki using affected versions of the SecurePoll extension are at risk if they visit malicious sites.