The interface_traduction_objets plugin injects untrusted request data into a hidden form field that is rendered without SPIP output filtering. Because fields prefixed with an underscore bypass protection mechanisms, the hidden content is rendered with filtering disabled, allowing an authenticated attacker with editor-level privileges to inject crafted content that is evaluated by SPIP’s template processing chain. This results in execution of arbitrary code within the web server context, giving the attacker full control over the affected system.

Sites running the SPIP interface_traduction_objets plugin with a version earlier than 2.2.2 are vulnerable. Any system that has this plugin installed—regardless of the SPIP core version—must be examined, because the flaw is present in the plugin itself and requires authenticated access by a user with editor or higher privileges to exploit.

The CVSS base score of 8.7 classifies this as high severity, though the EPSS probability is under 1% indicating a low observed exploitation rate to date. The vulnerability is not listed in the KEV catalog, but its impact is severe. Exploitation requires the attacker to authenticate and possess editor-level rights; once logged in, the attacker can craft a translation form submission that triggers the injection. Given the ease of exploitation for authorized users, administrators should treat this as an urgent risk.