SPIP CVE-2026-72709

No special conditions - remote unauthenticated exploitation against default configurations of SPIP versions before 4.4.18; the vulnerable ecrire/action/ endpoints are part of the standard installation. The only prerequisite is network reachability to the SPIP administration path (ecrire/) and the ability to obtain a valid action nonce, which any anonymous visitor can compute. Limiting factors are minimal: exploitation is blocked only if the ecrire/ back-office is network-restricted or already upgraded to 4.4.18. No authentication, no specific non-default setting, and no user interaction are required.

This is a genuine high-priority issue, not an inflated CVSS. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) aligns with the description: fully remote, no authentication, no user interaction, and low complexity, yielding administrator account takeover. Publicly available exploit code exists and the flaw was surfaced by VulnCheck, materially raising the likelihood of opportunistic exploitation, though it is NOT listed in CISA KEV, so this is 'publicly available exploit code exists' rather than confirmed active exploitation. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The one nuance to verify: the referenced Lexfo write-up describes a broader 'SQLi to RCE' chain, so operators should confirm whether editer_auteur password reset is the sole issue fixed in 4.4.18 or one link in a larger chain.

An unauthenticated attacker requests any SPIP page to obtain a valid HMAC-SHA256 nonce as the anonymous user, then computes the nonce for the editer_auteur action and issues a crafted HTTP request that resets the administrator's password to a value they control. Because public exploit code exists and no authentication or user interaction is required, the attacker logs in as administrator and takes full control of the CMS.