CVE-2026-27743: SPIP referer_spam < 1.3.0 Unauthenticated SQL Injection
The SPIP refererspam plugin versions prior to 1.3.0 contain an unauthenticated SQL injection vulnerability in the refererspamajouter and refererspamsupprimer action handlers. The handlers read the url parameter from a GET request and interpolate it directly into SQL LIKE clauses without input validation or parameterization. The endpoints do not enforce authorization checks and do not use SPIP action protections such as securiseraction(), allowing remote attackers to execute arbitrary SQL queries.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27743?
CVE-2026-27743 is classified as a high-severity vulnerability due to its potential to allow unauthenticated SQL injection.
How do I fix CVE-2026-27743?
To fix CVE-2026-27743, update the SPIP referer_spam plugin to version 1.3.0 or later.
What versions of SPIP referer_spam are affected by CVE-2026-27743?
Versions of the SPIP referer_spam plugin prior to 1.3.0 are affected by CVE-2026-27743.
What types of attack can CVE-2026-27743 enable?
CVE-2026-27743 can enable attackers to perform unauthenticated SQL injection attacks, potentially compromising the database.
Are there any mitigations for CVE-2026-27743 if I cannot update immediately?
If you cannot update immediately, consider disabling the referer_spam plugin to mitigate the risks of CVE-2026-27743.