CVE-2026-64874
A Joomla extension called Cache Cleaner Pro from regularlabs.com leaks CDN credentials in administrator request URLs. The flaw allows attackers to read these URLs and obtain full access to the CDN. This can lead to complete compromise of the CDN and the content it serves.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Joomla website owners who have installed the Cache Cleaner Pro extension from regularlabs.com, regardless of Joomla version.
Real-world impact
An attacker who can observe the exposed URLs can steal CDN credentials, giving them full control over the CDN. This enables the attacker to serve malicious content, read private data, or disrupt services for the affected site.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable over the network without authentication, provides attackers with complete control over the CDN, and has no mitigations in place. The high impact on confidentiality, integrity, and availability drives the critical rating.
What to do about it
- ›Disable or remove the Cache Cleaner Pro extension to stop credential leakage.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 23, 2026 · 9d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 27, 2026 · 5d agoAdvisory updatedThe NVD record was last revised.