CVE-2026-27743: Spip Referer Spam SQL injection (CVSS 9.8)

Description

The SPIP referer_spam plugin versions prior to 1.3.0 contain an unauthenticated SQL injection vulnerability in the referer_spam_ajouter and referer_spam_supprimer action handlers. The handlers read the url parameter from a GET request and interpolate it directly into SQL LIKE clauses without input validation or parameterization. The endpoints do not enforce authorization checks and do not use SPIP action protections such as securiser_action(), allowing remote attackers to execute arbitrary SQL queries.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Spip Referer Spam< 1.3.0

Remediation

Fixed in

Spip Referer Spam≥ 1.3.0

Patch & vendor advisories

https://git.spip.net/spip-contrib-extensions/referer_spam/-/commit/33682df73cd5f7e9c72d8c4d5088611fa2441683

References

https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-10.htmlRelease Notes
https://chocapikk.com/posts/2026/spip-plugins-vulnerabilities/ExploitThird Party Advisory
https://git.spip.net/spip-contrib-extensions/referer_spam/-/commit/33682df73cd5f7e9c72d8c4d5088611fa2441683Patch
https://plugins.spip.net/referer_spam.htmlProduct
https://www.vulncheck.com/advisories/spip-referer-spam-unauthenticated-sql-injectionThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-27743 being actively exploited?

CVE-2026-27743 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.74%.

How severe is CVE-2026-27743?

CVE-2026-27743 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 0.74% probability of exploitation.

Which products are affected by CVE-2026-27743?

Affected products include Spip Referer Spam.

How do I fix CVE-2026-27743?

Upgrade affected software to a fixed version, for example Spip Referer Spam 1.3.0 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-27743 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo