MediaWiki developer Happy-Melon discovered that the transwiki import feature ($wgImportSources) neglected to perform access control checks on form submission. Access control checks were only done before form display. Thus, a specially constructed POST request could be used to perform transwiki import without proper authorisation.
Transwiki import is not enabled by default. When it is enabled, it allows wiki pages to be copied from the wikis listed in $wgImportSources in LocalSettings.php.