CVE-2026-72710

This is a flaw that can allow a stranger to plant instructions in your website’s background task list. It is like someone slipping a forged work order into your office queue, then having a staff member carry it out as if it were legitimate.

This matters to you if you run a website using SPIP before version 4.4.18. An attacker does not need an account or a staff member to click anything; the risk applies when the SPIP site is reachable from the internet.

No known public exploit code is on record, and this issue is not listed in CISA’s catalog of vulnerabilities known to be actively exploited. Treat this as an amber priority: arrange the update promptly, especially for internet-facing SPIP sites, but there is no confirmed active-exploitation signal in the findings.

1. Confirm the deployed SPIP version on every production and staging instance, including sites managed by an external host.
2. Upgrade affected installations from any version before 4.4.18 to SPIP 4.4.18; test the upgrade in a non-production copy first and follow SPIP’s release notes for any application-specific compatibility changes.
3. If upgrading is delayed, restrict public access to the affected SPIP instance where operationally possible and disable or tightly control access to the vulnerable editing endpoint through a compensating web-server rule.
4. Review the spip_jobs queue and web-server/application logs for unexpected jobs, unusual PHP function names, or suspicious requests to editer_objet.php; investigate and rotate relevant credentials if compromise is found.
5. There is no CISA KEV remediation due date because CVE-2026-72710 is not listed in KEV.

CVE-2026-72710 is rated CVSS 9.8 (Critical), with network reachability, low attack complexity, no privileges, and no user interaction required. It is CWE-915 mass assignment in SPIP’s editer_objet action: an attacker-controlled arg can target internal SQL tables lacking a champs_editables allowlist, insert a controlled entry into spip_jobs, and obtain RCE when cron executes the queue. CISA KEV does not list the CVE, no public exploit code is on record, and EPSS predicts 0.6% likelihood (48th percentile) with a flat trend.