Critical severity9.8NVD Advisory· Published Feb 25, 2026· Updated Jun 17, 2026
CVE-2026-27743
CVE-2026-27743
Description
The SPIP referer_spam plugin versions prior to 1.3.0 contain an unauthenticated SQL injection vulnerability in the referer_spam_ajouter and referer_spam_supprimer action handlers. The handlers read the url parameter from a GET request and interpolate it directly into SQL LIKE clauses without input validation or parameterization. The endpoints do not enforce authorization checks and do not use SPIP action protections such as securiser_action(), allowing remote attackers to execute arbitrary SQL queries.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- SPIP/referer_spamv5Range: 0
Patches
Vulnerability mechanics
References
5- git.spip.net/spip-contrib-extensions/referer_spam/-/commit/33682df73cd5f7e9c72d8c4d5088611fa2441683nvdPatch
- chocapikk.com/posts/2026/spip-plugins-vulnerabilities/nvdExploitThird Party Advisory
- www.vulncheck.com/advisories/spip-referer-spam-unauthenticated-sql-injectionnvdThird Party Advisory
- blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-10.htmlnvdRelease Notes
- plugins.spip.net/referer_spam.htmlnvdProduct
News mentions
0No linked articles in our index yet.