CVE-2026-27743 is a critical unauthenticated SQL injection (CVSS 9.8) in the referer_spam plugin for SPIP. Versions before 1.3.0 are affected. The SPIP team lists 1.3.0 as the minimum safe version, so update the plugin from the admin space. The record does not mark the flaw as a CISA Known Exploited Vulnerability.
What's affected
The referer_spam plugin for SPIP, all versions before 1.3.0. The fixed version is 1.3.0.
This is a plugin flaw, not a flaw in SPIP itself. The SPIP 4.4.10 security release notice lists referer_spam among four plugins fixed in the same round, with 1.3.0 as the minimum version to use.
How to check if you're exposed
Open the plugin management page in the SPIP private area and read the installed version of Referer spam. Anything below 1.3.0 needs the update.
If you manage many SPIP sites, list the plugin directory on each server and check whether referer_spam is present at all. Sites that never installed it are not affected by this CVE.
The record describes two action handlers, referer_spam_ajouter and referer_spam_supprimer, that are reachable without authorization. Your web server logs for requests to those action names are a reasonable place to look for unexpected use, though absence in logs does not prove safety.
What to do now
- Update the Referer spam plugin to 1.3.0 or later from the SPIP admin space. The SPIP team also notes that the latest spip_loader (8.0.5 at the time of its notice) can update plugins.
- If you do not use the plugin, deactivate and remove it.
- Review web server logs for requests to the two action handlers named above and for unusual database errors around them.
- Consider a database backup before and after the update, and check that database accounts used by SPIP only hold the rights SPIP needs.
Why it matters
The record says the handlers read the url parameter from a GET request and place it directly into SQL LIKE clauses without validation or parameterization. They also skip authorization checks and SPIP's own action protections, so anyone who can reach the site can send queries. NVD classifies the flaw as CWE-89 (SQL Injection).
The usual lesson applies. Parameterized queries stop this class of bug, and an action handler that changes data should check who is asking before it does anything. Plugins carry the same risk as core code, and they are easy to forget in an inventory.
Hardening a SPIP site beyond this plugin
The SPIP announcement that covers this plugin also fixes three core issues in SPIP 4.4.10 and three other plugins, so it is worth reading in full and updating everything in one pass.
Keep a list of the plugins on each site. Plugins are easy to install and easy to forget, and an unmaintained one can hold a critical bug for years.
Give the database account SPIP uses only the rights it needs. An injection flaw is bounded by what the account can do.
Back up the database before updating, and test that you can restore it.
If you cannot update right away, deactivating the plugin removes the vulnerable handlers. That is a safer short term step than leaving a known unauthenticated injection point online.
Quick check
Is SPIP core affected?
The record names only the referer_spam plugin. The same SPIP announcement fixes other plugin and core issues separately, so read it for your version.
What is the safe version?
Version 1.3.0 of the plugin, per the SPIP announcement and the record.
Sources
Last reviewed: 19 October 2026.
