CVE-2026-27743 is an unauthenticated SQL injection vulnerability in the SPIP referer_spam plugin versions prior to 1.3.0. The issue arises because the referer_spam_ajouter and referer_spam_supprimer action handlers accept a URL parameter from a GET request and directly embed it into SQL LIKE clauses without sanitization or parameterization. Additionally, these handlers do not enforce authorization checks nor use SPIP's securiser_action() function, which normally protects action handlers. This combination allows remote attackers to execute arbitrary SQL commands on the backend database, potentially compromising data confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary SQL queries on the affected SPIP referer_spam plugin database. This can lead to unauthorized data access, data modification, or deletion. Given the lack of authentication and authorization checks, the attack surface is broad. The CVSS 4.0 score of 9.3 reflects a critical impact with high exploitability and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the vulnerable endpoints, implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting the referer_spam_ajouter and referer_spam_supprimer handlers, and monitor for suspicious activity. Applying input validation and parameterization in custom deployments can mitigate risk. Avoid exposing these endpoints publicly if possible.