CVE-2026-46670 is a pre-authentication SQL injection in YesWiki's FormManager::create() method, scoring CVSS 9.8. The severity is justified not by technical complexity but by deployment reality: this vulnerability lives in the default installation's core form-building functionality, not in a buried administrative endpoint. Anyone deploying YesWiki runs this code exposed to the internet by default.
The attack path is straightforward. The form-import feature accepts structured input, parses it, and writes directly to the database without parameterized queries. An unauthenticated attacker scanning for YesWiki instances can fire a payload without needing to discover malformed inputs or enumerate hidden endpoints. The impact extends beyond the wiki itself: the injection can reach the yeswiki_users table, exposing password hashes that can be cracked offline and reused across other systems where administrators may have recycled credentials. This lateral movement vector is particularly dangerous in YesWiki's typical deployment environment—small organizations, activist groups, and community wikis that often use shared administrative accounts across infrastructure.
The critical question for defenders is what 4.6.4's fix actually does. If it only adds authentication gating without parameterized queries, the method remains a security checkpoint that can fail in different ways. If it only parameterizes the INSERT without access control, any future bypass or injection-prone sibling method in FormManager recreates the same exposure. Given YesWiki's architectural choice to expose form functionality to anonymous users by default, the safer assumption is that other methods in FormManager share similar patterns—they were written before parameterized queries were standard practice in this codebase and haven't been revisited.
Beyond patching to 4.6.4, audit other FormManager methods (update, delete, importBatch) for the same injection pattern. Treat the user table as already compromised—force password resets across any systems where YesWiki credentials were reused. The 'default install' qualifier in this CVE isn't a technical footnote; it means exploitation is reliable across the entire install base with no hardening required.