CVE-2026-104447
HIGH
NVD
CVSS Score
7.1
Severity
HIGH
Published
Oct 02, 2026
Vendor
unknown
Description
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected GET requests. Attackers can lure a logged-in administrator to a crafted link with action=delete and a package parameter to remove extensions like bazar, breaking core site functionality.