CVE-2026-27744 is a critical unauthenticated remote code execution flaw (CVSS 9.8) in the tickets plugin for SPIP. Versions before 4.3.3 are affected, and 4.3.3 is the fixed version. Update the plugin from the SPIP admin space. The record does not mark it as a CISA Known Exploited Vulnerability.
What's affected
The tickets plugin for SPIP, all versions before 4.3.3. The fixed version is 4.3.3.
The flaw sits in the forum preview handling for public ticket pages, so sites that expose public tickets are the ones to look at first. The SPIP team lists the tickets plugin among four plugins fixed alongside SPIP 4.4.10, with 4.3.3 as the minimum version.
How to check if you're exposed
In the SPIP private area, open the plugin management page and read the version of the Tickets plugin. Anything below 4.3.3 needs the update.
Across several sites, check which servers have the plugin installed and whether public ticket pages are enabled. If the plugin is not installed, this CVE does not apply.
What to do now
- Update the tickets plugin to 4.3.3 or later from the admin space, or with the latest spip_loader as described in the SPIP announcement.
- If you do not need public tickets, deactivate or remove the plugin.
- Check the web server for files or processes you do not recognise if the site was publicly reachable while unpatched.
- Rotate database and application credentials stored on the server if you find any sign of tampering.
Why it matters
The record says the plugin builds HTML from untrusted request parameters, and a template later renders that HTML with unfiltered environment output, which turns off SPIP's output filtering. Crafted content then goes through SPIP's template processing and runs as code in the web server's context. NVD classifies it as CWE-94 (Improper Control of Generation of Code).
The shape of the bug is common in template engines. Any place where user input reaches a template as something to evaluate, rather than as text to print, needs the same care as an eval call. Treat output filters as a default that code should have to ask to switch off.
Hardening a SPIP site beyond this plugin
This plugin is one of four fixed in the same announcement, along with three core issues in SPIP 4.4.10. The announcement is worth reading in full, and updating everything in one pass is easier than returning to it.
If a site exposes public ticket pages, ask whether it needs them. Features that accept input from anyone should be on only where a person wants them.
After updating, check the site for files and accounts you do not recognise. A flaw that allows code execution is worth ten minutes of checking even after the patch.
If you run several SPIP sites for different clients, update the plugin on all of them in one session and write down the versions reached. Plugin fixes tend to be missed on sites that nobody has opened for months. Finally, keep the SPIP private area off the public internet where you can, since it is the part most often targeted.
Quick check
Do I need to be logged in to be at risk?
Per the record, no. The flaw is reachable without authentication through public ticket pages.
Where do I get the fix?
From the SPIP plugin site and the admin space plugin updater. The SPIP announcement names 4.3.3 as the minimum version.
Sources
Last reviewed: 19 October 2026.
