The SPIP interface_traduction_objets plugin contains an authenticated SQL injection flaw in its pipeline handling code. An editor‑level attacker can supply a crafted id_parent value that is directly concatenated into an SQL WHERE clause. This injection can exfiltrate sensitive data, alter database records, or potentially cause a denial of service depending on the underlying database configuration and user privileges. The weakness is an instance of CWE‑89, indicating unsanitized user input used in a database query.

Any installation of SPIP that has the interface_traduction_objets plugin at a version earlier than 2.2.2 is vulnerable. The plugin is available for download from the SPIP website or via the SPIP package repository, and the vulnerability applies to all SPIP sites that have not upgraded the plugin to the patched 2.2.2 release. No other SPIP components are reported as affected.

The CVSS v3.1 score of 7.1 places the issue in the Medium severity range, while the EPSS score of less than 1% indicates a very low but non‑zero likelihood of exploitation in the wild. The vulnerability requires an authenticated user with editor privileges, limiting the threat to sites with ample editor accounts or compromised credentials. As the vulnerability is not listed in the CISA KEV catalog, no widespread active exploits are currently documented.