CVE-2026-27743Disclosure(spip / referer_spam)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch spip referer_spam systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The SPIP referer_spam plugin versions prior to 1.3.0 contain an unauthenticated SQL injection vulnerability in the referer_spam_ajouter and referer_spam_supprimer action handlers. The handlers read the url parameter from a GET request and interpolate it directly into SQL LIKE clauses without input validation or parameterization. The endpoints do not enforce authorization checks and do not use SPIP action protections such as securiser_action(), allowing remote attackers to execute arbitrary SQL queries.

spip CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://git.spip.net/spip-contrib-extensions/referer_spam/-/commit/33682df73cd5f7e9c72d8c4d5088611fa2441683

Exploit / PoC references

https://chocapikk.com/posts/2026/spip-plugins-vulnerabilities/

Vendor / third-party advisories

https://www.vulncheck.com/advisories/spip-referer-spam-unauthenticated-sql-injection

Other references

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

referer_spam

Threat summary

Patch or workaround signal is available
5 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 5 signals
Disclosure: 4 classified signals
Peaked 1d ago at 4 mentions (2026-02-25); latest day: 1
5 total mentions across 2 days

Affected systems

Vendors

spip

Products

referer_spam

Deep dive

Activity timeline5 mentions / 2d

Signal classification2 categories

Disclosure

480.0%

Patch

120.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-25	4	Disclosure3Patch1
2026-03-02	1	Disclosure1

Full discourse5 posts

Vulmon Vulnerability Feed@VulmonFeeds226d
Disclosure
CVE-2026-27743 SQL Injection in SPIP Referer Spam Plugin Before 1.3.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27743
Post summary
A SQL injection vulnerability (CVE-2026-27743) exists in SPIP Referer Spam Plugin versions prior to 1.3.0.
0001048
4.0K followersView on X
CRAC Learning - Tech@cracbot220d
Disclosure
CVE-2026-27743 (CVSS:9.3, CRITICAL) is Analyzed. The SPIP referer_spam plugin versions prior to 1.3.0 contain an unauthenticated SQL injection vulnerability in the refer..https://nvd.nist.gov/vuln/detail/CVE-2026-27743 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post announces a critical SQL injection vulnerability (CVE‑2026‑27743) in the SPIP referer_spam plugin, providing CVSS details and linking to the NVD entry.
0000039
173 followersView on X
The Hacker Wire@TheHackerWire225d
Disclosure
🔴 CVE-2026-27743 - Critical The SPIP referer_spam plugin versions prior to 1.3.0 contain an unauthenticated SQL injection vulnerability in the referer_spam_ajouter and referer_spam_supprimer action handlers. The ha... https://www.thehackerwire.com/vulnerability/CVE-2026-27743/ https://t.co/KyrbL0FKOG
Post summary
The post announces a critical unauthenticated SQL injection vulnerability in SPIP's referer_spam plugin (versions <1.3.0), detailing affected action handlers but not providing PoC or patch info.
0000038
115 followersView on X
CVE@CVEnew225d
Disclosure
CVE-2026-27743 The SPIP referer_spam plugin versions prior to 1.3.0 contain an unauthenticated SQL injection vulnerability in the referer_spam_ajouter and referer_spam_supprimer act… https://www.cve.org/CVERecord?id=CVE-2026-27743
Post summary
The CVE-2026-27743 entry reports an unauthenticated SQL injection in the SPIP referer_spam plugin (versions <1.3.0), but provides no PoC, exploit code, or patch details.
00000118
56.6K followersView on X
OffSeq | Adversary Tactics for Cyber Resilience@offseq225d
Patch
🚨 CRITICAL: CVE-2026-27743 in SPIP referer_spam lets unauth'd attackers run SQL via GET requests — no exploit yet, but risk is high. PATCH to 1.3.0+ ASAP to safeguard data! 🔒 https://radar.offseq.com/threat/cve-2026-27743-cwe-89-improper-neutralization-of-s-0723b396 #OffSeq #S... https://t.co/gvIXnSo9Eo
Post summary
CVE-2026-27743 is a critical SQL injection in SPIP’s referer_spam module; no exploit exists yet, but the advisory urges applying patch 1.3.0+ immediately.
0000039
270 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	spip	referer_spam	-	-	-

Explore more

Back to dashboard spip CVEs referer_spam vulnerabilities

What researchers are saying

CVE-2026-27743

OffSeq | Adversary Tactics for Cyber Resilience[verified]@offseqPatch

CVE-2026-27743 is a critical SQL injection in SPIP’s referer_spam module; no exploit exists yet, but the advisory urges applying patch 1.3.0+ immediately.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

A SQL injection vulnerability (CVE-2026-27743) exists in SPIP Referer Spam Plugin versions prior to 1.3.0.

CRAC Learning - Tech@cracbotDisclosure

The post announces a critical SQL injection vulnerability (CVE‑2026‑27743) in the SPIP referer_spam plugin, providing CVSS details and linking to the NVD entry.

The Hacker Wire@TheHackerWireDisclosure

The post announces a critical unauthenticated SQL injection vulnerability in SPIP's referer_spam plugin (versions <1.3.0), detailing affected action handlers but not providing PoC or patch info.

CVE@CVEnewDisclosure

The CVE-2026-27743 entry reports an unauthenticated SQL injection in the SPIP referer_spam plugin (versions <1.3.0), but provides no PoC, exploit code, or patch details.