Is CVE-2026-104447 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-104447?

CVE-2026-104447 has a CVSS v3 severity of HIGH (7.1).

Back

CVE-2026-104447

Description

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected GET requests. Attackers can lure a logged-in administrator to a crafted link with action=delete and a package parameter to remove extensions like bazar, breaking core site functionality.