An authenticated remote code execution vulnerability in the SPIP interface_traduction_objets plugin allows attackers with editor-level privileges to execute arbitrary code on the underlying web server.

The plugin fails to sanitize user input placed into hidden form fields prefixed with an underscore. An authenticated attacker with editor-level privileges can inject malicious content that bypasses SPIP output filtering, leading to remote code execution when the template engine processes the input.

The vulnerability carries a CVSS score of 8.8, reflecting its high severity. Successful exploitation grants an attacker the ability to execute arbitrary commands in the context of the web server, which can lead to full compromise of the application, unauthorized access to sensitive site data, and potential lateral movement within the hosting environment.

Immediate Action: Update the interface_traduction_objets plugin to version 2.2.2 or later immediately to incorporate the necessary input filtering and security patches.

Proactive Monitoring: Monitor server-side logs for unusual activity, particularly requests involving the translation interface workflow or attempts to inject PHP tags into form fields.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block requests containing suspicious patterns or PHP code injection attempts directed at the SPIP translation endpoints.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the security research write-up by Chocapikk.

Given the potential for remote code execution, this vulnerability poses a significant risk to the integrity and confidentiality of the affected SPIP installation. Administrators should prioritize updating the interface_traduction_objets plugin to version 2.2.2 as soon as possible. If an immediate update is not feasible, restrict access to the translation interface workflow to trusted users and implement restrictive WAF rules to mitigate the risk of exploit attempts.