CVE-2025-53625 DynamicPageList3 exposes hidden/suppressed usernames
Attackers can retrieve hidden or suppressed usernames via DynamicPageList3 parameters, exposing private user data in MediaWiki installations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-53625?
CVE-2025-53625 is a high-severity vulnerability in Universal-Omega DynamicPageList3, published on 10 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and details. Several #dpl parameters can leak usernames that have been hidden using revision deletion, suppression, or the hideuser block flag. The vulnerability is fixed in 3.6.4.
Weakness: CWE-359
Which versions are affected by CVE-2025-53625?
2 open source packages ship an affected version, including universal-omega/dynamic-page-list3.
| Package | Affected | Fixed in |
|---|---|---|
universal-omega/dynamic-page-list3 Packagist | All versions | 3.6.4 |
universal-omega/dynamic-page-list3 Packagist | All versions | 3.6.4 |
How do I fix CVE-2025-53625?
Upgrade universal-omega/dynamic-page-list3 to 3.6.4 or later.
Is CVE-2025-53625 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-53625 exists.
Sources
Also known as GHSA-7pgw-q3qp-6pgq.