PT-2026-21859 · WordPress · Spip Tickets Plugin

Valentin Lobstein + 1 · Published 2026-02-25 · Updated 2026-03-02 · CVE-2026-27744

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SPIP tickets plugin versions prior to 4.3.3

Description The SPIP tickets plugin is affected by a remote code execution issue. An unauthenticated attacker can execute code on the web server through crafted content injection. The plugin appends untrusted request parameters into HTML that is rendered by a template using unfiltered environment rendering (#ENV), disabling SPIP output filtering. This allows the attacker to inject content that is evaluated by SPIP’s template processing chain.

Recommendations Update the SPIP tickets plugin to version 4.3.3 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-27744

Affected Products

Spip Tickets Plugin

References · 13

• 🔥 https://chocapikk.com/posts/2026/spip-plugins-vulnerabilities · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-27744 · Security Note
• https://git.spip.net/spip-contrib-extensions/tickets/-/commit/869935b6687822ed79ad5477626a664d8ea6dcf7 · Patch
• https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-10.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27744 · Vendor Advisory
• https://vulncheck.com/advisories/spip-tickets-unauthenticated-rce · Note
• https://twitter.com/CVEnew/status/2026641357649945051 · Twitter Post
• https://twitter.com/cracbot/status/2028425214149931451 · Twitter Post
• https://plugins.spip.net/tickets · Note
• https://t.me/cveNotify/153579 · Telegram Post
• https://t.me/CVEtracker/45685 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2026535262273015936 · Twitter Post
• https://twitter.com/TheHackerWire/status/2026725864298389933 · Twitter Post