Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2026-74253: Joomla Extension - regularlabs.com - Unauthenticated Code Execution
CVE-2026-74253 · published 17 days ago
Summary
The Regular Labs Sourcerer extension in Joomla doesn't properly check the source of code it processes. This means an attacker could inject malicious code into a Joomla site, potentially allowing them to take control of the site. To protect your site, update the Regular Labs Sourcerer extension to version 14.0.0 or later.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| regularlabs.com | sourcerer extension for joomla |
1.0.0-13.1.1 1.0.0-15.0.0 |
Original advisory text
Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 16.0.0
Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 16.0.0 - Regular Labs Sourcerer before 16.0.0 processes {source} blocks found in Joomla’s final rendered HTML without reliably determining where that code originated.
References
- https://regularlabs.com/ product
Severity
10.0
Critical
Exploitation
EPSS <1%
Type
CWE-94Code Injection
Timeline
Published17 Aug 2026
Updated1 Sep 2026
First seen17 Aug 2026
Monitor software like this
Free during beta