PHP code injection in Sourcerer extension used with Articles Anywhere
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.
Summary
Regular Labs Sourcerer extension for Joomla before 17.0.1 is affected when used with Articles Anywhere before 20.1.1. Improper control of code generation (CWE-94) lets Sourcerer run PHP from an included article under the enclosing article's trusted identity instead of its own. A user with high privileges can cause PHP code to run with high impact to confidentiality, integrity and availability.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Description from the CNA
Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension < 20.1.1 - Sourcerer can restrict PHP in articles according to article-author trust; the exact creator and last-editor rule varies by release. Articles Anywhere can insert the text or full layout of one article into another. In the affected combination, when Articles Anywhere processes an inclusion before Sourcerer and Force Content Triggers is off, the included article's Sourcerer code can be evaluated using the enclosing article's trusted identity rather than the included article's own identity. The resulting gap is between the authority of the article supplying the code and the authority used to decide whether to run it. Ordinary Articles Anywhere output is not itself the issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| regularlabs.com | Sourcerer Free extension for Joomla | 13.0.0-17.0.0 | — | No fix listed | CNA |
| regularlabs.com | Sourcerer Pro extension for Joomla | 3.0.0-17.0.0 | — | No fix listed | CNA |
| regularlabs.com | Articles Anywhere extension for Joomla | 1.4.5-20.1.0 | — | No fix listed | CNA |
- Sourcerer Free extension for Joomla Vendorregularlabs.com Affected 13.0.0-17.0.0 Fixed in — No fix listed CNA
- Sourcerer Pro extension for Joomla Vendorregularlabs.com Affected 3.0.0-17.0.0 Fixed in — No fix listed CNA
- Articles Anywhere extension for Joomla Vendorregularlabs.com Affected 1.4.5-20.1.0 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for Sourcerer Free extension for Joomla, Sourcerer Pro extension for Joomla or Articles Anywhere extension for Joomla.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Timeline
- 2026-11-02 Threatist record created from CVE-2026-102802
- 2026-11-02 Alias added: GHSA-6xfh-f8pc-77x8
- 2026-11-02 CISA SSVC decision points changed
- 2026-11-02 Priority changed: MEDIUM → LOW
- 2026-11-04 Priority changed: LOW → MEDIUM
References
Other 1
More regularlabs.com vulnerabilities
- TI-2026-46603 Path traversal in regularlabs.com GeoIP extension for Joomla CVSS 3.1CRITICAL 9.8
- TI-2025-16115 Extension - regularlabs.com - Remote code execution vulnerability in the Sourcerer extensions < 12.0.0 for Joomla CVSS 3.1CRITICAL 9.8
- TI-2026-52038 Code injection in regularlabs.com Sourcerer extension for Joomla CVSS 4.0CRITICAL 10.0
- TI-2026-46380 Information disclosure in regularlabs.com Cache Cleaner Pro extension for Joomla CVSS 3.1CRITICAL 9.8
- TI-2026-46379 Server-side request forgery in regularlabs.com Cache Cleaner Pro extension for Joomla CVSS 3.1CRITICAL 9.8
- TI-2026-46326 Improper access control in regularlabs.com Sourcerer extension for Joomla CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-102802 · CVE Program
- CVE-2026-102802 · NVD
- FIRST EPSS
- GHSA-6xfh-f8pc-77x8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences