Vulnerability · Published Feb 25, 2026 · Assigned by VulnCheck
CVE-2026-27743SPIP referer_spam < 1.3.0 Unauthenticated SQL Injection
Critical 9.8
In plain English
A critical-severity SQL injection in referer_spam from SPIP. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Official description
The SPIP referer_spam plugin versions prior to 1.3.0 contain an unauthenticated SQL injection vulnerability in the referer_spam_ajouter and referer_spam_supprimer action handlers. The handlers read the url parameter from a GET request and interpolate it directly into SQL LIKE clauses without input validation or parameterization. The endpoints do not enforce authorization checks and do not use SPIP action protections such as securiser_action(), allowing remote attackers to execute arbitrary SQL queries.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SPIP | referer_spam | 0 – before 1.3.0 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://chocapikk.com/posts/2026/spip-plugins-vulnerabilities/ technical-description, exploit
- https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-10.html vendor-advisory
- https://plugins.spip.net/referer_spam.html product
- https://git.spip.net/spip-contrib-extensions/referer_spam/-/commit/33682df73cd5f7e9c72d8c4d5088611fa2441683 patch
- https://www.vulncheck.com/advisories/spip-referer-spam-unauthenticated-sql-injection third-party-advisory