CVE-2026-64796
A Joomla extension called Sourcerer from regularlabs.com contains multiple code‑injection flaws that let attackers run arbitrary PHP code on a site. The bugs bypass user‑role checks and permission settings, allowing malicious scripts to be executed without any special privileges.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Joomla sites that have installed the Sourcerer extension (both the free and pro editions) from regularlabs.com.
Real-world impact
An attacker who exploits these flaws can execute arbitrary PHP code on the web server, modify or delete site content, steal sensitive data, and potentially take full control of the affected Joomla installation.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability can be exploited over the network with no authentication, no user interaction, and low complexity, giving an attacker complete confidentiality, integrity, and availability impact.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 22, 2026 · 10d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 27, 2026 · 5d agoAdvisory updatedThe NVD record was last revised.