CVE-2026-27743
SPIP referer_spam < 1.3.0 Unauthenticated SQL Injection
- State
- Published
- Severity
- 9.3 Critical
- Published
- Feb 25, 2026
- Updated
- May 25, 2026
- Reserved
- Feb 23, 2026
Description
The SPIP referer_spam plugin versions prior to 1.3.0 contain an unauthenticated SQL injection vulnerability in the referer_spam_ajouter and referer_spam_supprimer action handlers. The handlers read the url parameter from a GET request and interpolate it directly into SQL LIKE clauses without input validation or parameterization. The endpoints do not enforce authorization checks and do not use SPIP action protections such as securiser_action(), allowing remote attackers to execute arbitrary SQL queries.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Products
| Product | Versions |
|---|---|
referer_spamSPIP |
|
References
- https://chocapikk.com/posts/2026/spip-plugins-vulnerabilities/technical-descriptionexploit
- https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-10.htmlvendor-advisory
- https://plugins.spip.net/referer_spam.htmlproduct
- https://git.spip.net/spip-contrib-extensions/referer_spam/-/commit/33682df73cd5f7e9c72d8c4d5088611fa2441683patch
- https://www.vulncheck.com/advisories/spip-referer-spam-unauthenticated-sql-injectionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.