Affected versions: ≥ 19.0.0 and < 20.1.1
Full advisory: our disclosure post
CVE-2026-102802HighAdded to mySites.guru 31 October 2026
Articles Anywhere (articlesanywhere) 19.0.0 to below 20.1.1 - Authenticated PHP Execution via Included Articles when Sourcerer is also installed
CVE-2026-102802 (CVE record reserved, not yet published). When Regular Labs Sourcerer is installed alongside Articles Anywhere, an article included through an Articles Anywhere tag had its Sourcerer PHP run under the trust of the HOST article rather than its own author. A content author whose own articles are not trusted to run Sourcerer PHP could therefore get their PHP executed by having their article pulled into a trusted article (for example by a category or latest-articles listing). Sites without Sourcerer are not affected by this issue. The fix is joint: update Articles Anywhere to 20.1.1 or later AND Sourcerer to 17.0.1 or later (31 October 2026); updating only one of the two leaves the site exposed. Free and Pro editions are both affected. Temporary mitigation: restrict which user groups can create or edit articles, or disable Sourcerer PHP in articles until both extensions are updated.
Is my site affected?
- Affected
- Articles Anywhere from 19.0.0 up to but not including 20.1.1
- Fixed in
- 20.1.1
- What to do
- Update Articles Anywhere to 20.1.1 or later.
How severe CVE-2026-102802 is
The published CVE record has no CVSS score, so there is no vector to break down here. mySites.guru rates it High, and that is the rating your sites are checked against.
Timeline
- 31 October 2026mySites.guru check added for Articles Anywhere (from 19.0.0 up to but not including 20.1.1)
- 31 October 2026We published: Articles Anywhere 20.1.1 and Sourcerer 17.0.1 Fix One Issue Together
Rule details
Our disclosure post
Other vulnerabilities in Articles Anywhere and Articles Anywhere
Updating for CVE-2026-102802 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extensions.
Articles Anywhere
Latest safe version: 20.1.1
- CVE-2026-64793 Critical, up to and including 18.0.2
- CVE-2026-64794 Critical, up to and including 18.0.2
- CVE-2026-64795 Critical, up to and including 18.0.2
- CVE-2026-64799 Critical, up to and including 18.0.2
- CVE-2026-65755 Critical, up to and including 18.0.2
- CVE-2026-85195 High, from 19.0.0 up to but not including 20.0.0
- CVE-2026-85196 High, from 19.0.0 up to but not including 20.0.0
Articles Anywhere
Latest safe version: 20.1.1
- CVE-2026-85195 High, from 19.0.0 up to but not including 20.0.0
- CVE-2026-85196 High, from 19.0.0 up to but not including 20.0.0
References
- CVE-2026-102802 on cve.org (the official CVE record)
- CVE-2026-102802 in the NIST National Vulnerability Database
- Articles Anywhere 20.1.1 and Sourcerer 17.0.1 Fix One Issue Together
CVE-2026-102802 questions
Which versions are affected by CVE-2026-102802?
CVE-2026-102802 affects Articles Anywhere from 19.0.0 up to but not including 20.1.1. The fix is in 20.1.1.
How do I fix CVE-2026-102802?
Update Articles Anywhere to 20.1.1 or later. Then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
How severe is CVE-2026-102802?
The published CVE record has no CVSS score. mySites.guru rates it High.
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.
Rules current as of 31 October 2026.