Regular Labs DB Replacer
Affected versions: ≤ 8.2.7
Full advisory: our disclosure post
CVE-2026-63265HighCVSS 8.0CVE published 22 July 2026Added to mySites.guru 22 July 2026
Regular Labs DB Replacer (com_dbreplacer) <= 8.2.7 - Broken Access Control (unauthorised database replacements)
Regular Labs DB Replacer up to and including 8.2.7. Administrator routes and replacement requests did not consistently require Super User permission and a valid token, so an unauthorised backend user or a CSRF attack could run database replacements across the site - potentially causing major data corruption or full site compromise. Also affected by CVE-2026-63265, missing CSRF tokens and permission checks on the shared Regular Labs AJAX endpoints. Fixed in the Regular Labs security release of 22 July 2026 (9.0.0).
Is my site affected?
CVE-2026-63265 is checked by 10 rules. Find the extension and release line your site runs:
| Extension | Affected versions | Fixed in | What to do |
|---|---|---|---|
| Regular Labs DB Replacer | up to and including 8.2.7 | after 8.2.7 | Update Regular Labs DB Replacer to the newest release from the vendor. This flaw covers versions up to 8.2.7, so any later release is outside it. |
| Regular Labs IP Login | up to and including 6.2.5 | after 6.2.5 | Update Regular Labs IP Login to the newest release from the vendor. This flaw covers versions up to 6.2.5, so any later release is outside it. |
| Regular Labs Extension Manager | up to and including 9.2.5 | after 9.2.5 | Update Regular Labs Extension Manager to the newest release from the vendor. This flaw covers versions up to 9.2.5, so any later release is outside it. |
| Snippets | up to and including 9.3.10 | after 9.3.10 | Update Snippets to the newest release from the vendor. This flaw covers versions up to 9.3.10, so any later release is outside it. |
| Tabs & Accordions | up to and including 2.5.6 | after 2.5.6 | Update Tabs & Accordions to the newest release from the vendor. This flaw covers versions up to 2.5.6, so any later release is outside it. |
| Advanced Module Manager | up to and including 11.0.1 | after 11.0.1 | Update Advanced Module Manager to the newest release from the vendor. This flaw covers versions up to 11.0.1, so any later release is outside it. |
| Quick Index | up to and including 4.3.6 | after 4.3.6 | Update Quick Index to the newest release from the vendor. This flaw covers versions up to 4.3.6, so any later release is outside it. |
| Regular Labs Better Frontend Link | up to and including 2.2.5 | after 2.2.5 | Update Regular Labs Better Frontend Link to the newest release from the vendor. This flaw covers versions up to 2.2.5, so any later release is outside it. |
| Regular Labs CDN | up to and including 7.3.7 | after 7.3.7 | Update Regular Labs CDN to the newest release from the vendor. This flaw covers versions up to 7.3.7, so any later release is outside it. |
| Regular Labs Email Protector | up to and including 6.3.7 | after 6.3.7 | Update Regular Labs Email Protector to the newest release from the vendor. This flaw covers versions up to 6.3.7, so any later release is outside it. |
How CVE-2026-63265 is scored
The base metrics as CISA-ADP published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.
8.0 High
CVSS 3.1, scored by CISA-ADPCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HHow it is reached
- AV:N Attack vector
- Network. Reachable across the internet
- AC:L Attack complexity
- Low. Nothing to work around, it just works
- PR:L Privileges required
- Low. Any logged-in account will do
- UI:R User interaction
- Required. Someone has to click or visit something
- S:U Scope
- Unchanged. Contained to the extension it is in
What it does
- C:H Confidentiality
- High. Everything the site holds can be read
- I:H Integrity
- High. Data and files can be altered at will
- A:H Availability
- High. The site can be taken down
Timeline
- 22 July 2026CVE-2026-63265 record published by its CNA
- 22 July 2026mySites.guru check added for Regular Labs DB Replacer (up to and including 8.2.7)
- 22 July 2026mySites.guru check added for Regular Labs IP Login (up to and including 6.2.5)
- 22 July 2026mySites.guru check added for Regular Labs Extension Manager (up to and including 9.2.5)
- 22 July 2026mySites.guru check added for Snippets (up to and including 9.3.10)
- 22 July 2026mySites.guru check added for Tabs & Accordions (up to and including 2.5.6)
- 22 July 2026mySites.guru check added for Advanced Module Manager (up to and including 11.0.1)
- 22 July 2026mySites.guru check added for Quick Index (up to and including 4.3.6)
- 22 July 2026mySites.guru check added for Regular Labs Better Frontend Link (up to and including 2.2.5)
- 22 July 2026mySites.guru check added for Regular Labs CDN (up to and including 7.3.7)
- 22 July 2026mySites.guru check added for Regular Labs Email Protector (up to and including 6.3.7)
- 22 July 2026We published: Regular Labs Patched Its Whole Joomla Extension Catalogue at Once
Rule details
Regular Labs IP Login - Regular Labs IP Login (iplogin) <= 6.2.5 - Client-IP Spoofing and Weak Login Key Entropy (account impersonation)
Regular Labs IP Login up to and including 6.2.5. IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy, so an attacker could spoof the IP used for automatic login and impersonate the mapped account (CVE-2026-64797). Persistent URL login keys were also generated with a non-cryptographic random generator with insufficient entropy, making them guessable (CVE-2026-64798). Also affected by CVE-2026-63265. Fixed in the Regular Labs security release of 22 July 2026 (7.0.0).
Affected versions: ≤ 6.2.5
Full advisory: our disclosure post
Regular Labs Extension Manager - Regular Labs Extension Manager (com_regularlabsmanager) <= 9.2.5 - Broken Access Control (unauthorised extension install/update/uninstall)
Regular Labs Extension Manager up to and including 9.2.5. Administrator routes and the install/update/uninstall processing did not consistently enforce component-management and installation permissions, so an unauthorised backend user, or a CSRF attack against a logged-in administrator, could install, update or remove Joomla extensions - which is a site takeover primitive. Also affected by CVE-2026-63265, missing CSRF tokens and permission checks on the shared Regular Labs AJAX endpoints. Fixed in the Regular Labs security release of 22 July 2026 (9.3.0). Update via Joomla Update or the Regular Labs Extension Manager.
Affected versions: ≤ 9.2.5
Full advisory: our disclosure post
Snippets - Regular Labs Snippets (com_snippets) <= 9.3.10 - Broken Access Control and Search Index Content Disclosure
Regular Labs Snippets up to and including 9.3.10. Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks, so unauthorised backend users or a CSRF attack could expose, create or modify extension configuration and items (CVE-2026-63684). Smart Search indexing could also store restricted content in the public search index (CVE-2026-64792), and the shared Regular Labs AJAX endpoints lacked consistent CSRF and permission checks (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (10.0.0). Note this rule matches the com_snippets component deliberately: the plugin element "snippets" is also used by the unrelated "Page Builder CK - Snippets" plugin.
Affected versions: ≤ 9.3.10
Full advisory: our disclosure post
Tabs & Accordions - Regular Labs Tabs & Accordions (tabsaccordions) <= 2.5.6 - Access Control and Search Index Content Disclosure
Regular Labs Tabs & Accordions up to and including 2.5.6. Smart Search indexing could render generated content using the indexing administrator identity instead of a public guest, so restricted or administrator-only content could be stored in the public search index and disclosed to visitors (CVE-2026-64792). Also affected by CVE-2026-63265, missing CSRF tokens and permission checks on the shared Regular Labs AJAX endpoints. Fixed in the Regular Labs security release of 22 July 2026 (3.0.0).
Affected versions: ≤ 2.5.6
Full advisory: our disclosure post
Advanced Module Manager - Regular Labs Advanced Module Manager (com_advancedmodules) <= 11.0.1 - Broken Access Control, Stored XSS and GeoIP Rule Bypass
Regular Labs Advanced Module Manager up to and including 11.0.1, via the bundled Conditions component and the shared Regular Labs library. Conditions administration did not consistently enforce tokens and component/mapped-item permissions (CVE-2026-63280); stored condition values could execute HTML/JavaScript in administrator summaries (CVE-2026-63281); IP and GeoIP conditions trusted spoofable forwarded headers, letting a remote client bypass location-based display rules (CVE-2026-63683); and privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens or matching permissions (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (12.0.0).
Affected versions: ≤ 11.0.1
Full advisory: our disclosure post
Quick Index - Regular Labs Quick Index (quickindex) <= 4.3.6 - Broken Access Control (Regular Labs AJAX endpoints)
Regular Labs Quick Index up to and including 4.3.6. Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration, so authenticated lower-privileged users, or a CSRF attack, could invoke lookups or mutations outside their authorisation (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (5.0.0).
Affected versions: ≤ 4.3.6
Full advisory: our disclosure post
Regular Labs Better Frontend Link - Regular Labs Better Frontend Link (mod_betterfrontendlink) <= 2.2.5 - Broken Access Control
Regular Labs Better Frontend Link up to and including 2.2.5. Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (2.2.6).
Affected versions: ≤ 2.2.5
Full advisory: our disclosure post
Regular Labs CDN - Regular Labs CDN for Joomla (cdnforjoomla) <= 7.3.7 - Path Traversal and Credential Exposure
Regular Labs CDN for Joomla up to and including 7.3.7. CDN versioning could check file paths outside the site directory, exposing local file existence and modification metadata (CVE-2026-65712). Also affected by CVE-2026-63265, missing CSRF tokens and permission checks on the shared Regular Labs AJAX endpoints. Note the related Cache Cleaner issue CVE-2026-64874, where CDN credentials were exposed in administrator request URLs, is covered by the Cache Cleaner rule. Fixed in the Regular Labs security release of 22 July 2026 (8.0.0).
Affected versions: ≤ 7.3.7
Full advisory: our disclosure post
Regular Labs Email Protector - Regular Labs Email Protector (emailprotector) <= 6.3.7 - Broken Access Control (Regular Labs AJAX endpoints)
Regular Labs Email Protector up to and including 6.3.7. Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration, so authenticated lower-privileged users, or a CSRF attack, could invoke lookups or mutations outside their authorisation (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (6.3.8).
Affected versions: ≤ 6.3.7
Full advisory: our disclosure post
Our disclosure post
Other vulnerabilities in Snippets, Tabs & Accordions, Advanced Module Manager, Quick Index, Regular Labs CDN, Regular Labs DB Replacer, Regular Labs IP Login and Regular Labs Extension Manager
Updating for CVE-2026-63265 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extensions.
Snippets
Latest safe version: 11.0.0
- CVE-2026-88852 High, from 10.0.0 up to but not including 11.0.0
- CVE-2026-63684 Medium, up to and including 9.3.10
- CVE-2026-64792 Medium, up to and including 9.3.10
Tabs & Accordions
Latest safe version: 3.2.0
- CVE-2026-100751 High, from 2.3.0 up to but not including 3.2.0
- CVE-2026-85191 High, from 3.0.0 up to but not including 3.1.0
- CVE-2026-64792 Medium, up to and including 2.5.6
Advanced Module Manager
Latest safe version: 12.1.0
- CVE-2026-85188 Medium, from 12.0.0 up to but not including 12.1.0
- CVE-2026-63280 Medium, up to and including 11.0.1
- CVE-2026-63281 Medium, up to and including 11.0.1
- CVE-2026-63683 Medium, up to and including 11.0.1
Regular Labs CDN
- CVE-2026-65712 Medium, up to and including 7.3.7
Regular Labs DB Replacer
- CVE-2026-63685 High, up to and including 8.2.7
Regular Labs IP Login
- CVE-2026-64797 High, up to and including 6.2.5
- CVE-2026-64798 High, up to and including 6.2.5
Regular Labs Extension Manager
- CVE-2026-64791 High, up to and including 9.2.5
References
- CVE-2026-63265 on cve.org (the official CVE record)
- CVE-2026-63265 in the NIST National Vulnerability Database
- Regular Labs Patched Its Whole Joomla Extension Catalogue at Once
CVE-2026-63265 questions
Which versions are affected by CVE-2026-63265?
CVE-2026-63265 is covered by 10 rules: Regular Labs DB Replacer up to and including 8.2.7; Regular Labs IP Login up to and including 6.2.5; Regular Labs Extension Manager up to and including 9.2.5; Snippets up to and including 9.3.10; Tabs & Accordions up to and including 2.5.6; Advanced Module Manager up to and including 11.0.1; Quick Index up to and including 4.3.6; Regular Labs Better Frontend Link up to and including 2.2.5; Regular Labs CDN up to and including 7.3.7; Regular Labs Email Protector up to and including 6.3.7.
How do I fix CVE-2026-63265?
It depends on the extension and release line your site runs. For Regular Labs DB Replacer up to and including 8.2.7: update Regular Labs DB Replacer to the newest release from the vendor. This flaw covers versions up to 8.2.7, so any later release is outside it. For Regular Labs IP Login up to and including 6.2.5: update Regular Labs IP Login to the newest release from the vendor. This flaw covers versions up to 6.2.5, so any later release is outside it. For Regular Labs Extension Manager up to and including 9.2.5: update Regular Labs Extension Manager to the newest release from the vendor. This flaw covers versions up to 9.2.5, so any later release is outside it. For Snippets up to and including 9.3.10: update Snippets to the newest release from the vendor. This flaw covers versions up to 9.3.10, so any later release is outside it. For Tabs & Accordions up to and including 2.5.6: update Tabs & Accordions to the newest release from the vendor. This flaw covers versions up to 2.5.6, so any later release is outside it. For Advanced Module Manager up to and including 11.0.1: update Advanced Module Manager to the newest release from the vendor. This flaw covers versions up to 11.0.1, so any later release is outside it. For Quick Index up to and including 4.3.6: update Quick Index to the newest release from the vendor. This flaw covers versions up to 4.3.6, so any later release is outside it. For Regular Labs Better Frontend Link up to and including 2.2.5: update Regular Labs Better Frontend Link to the newest release from the vendor. This flaw covers versions up to 2.2.5, so any later release is outside it. For Regular Labs CDN up to and including 7.3.7: update Regular Labs CDN to the newest release from the vendor. This flaw covers versions up to 7.3.7, so any later release is outside it. For Regular Labs Email Protector up to and including 6.3.7: update Regular Labs Email Protector to the newest release from the vendor. This flaw covers versions up to 6.3.7, so any later release is outside it.
How severe is CVE-2026-63265?
CISA-ADP scores it 8.0 (High) under CVSS 3.1. In plain terms: reachable across the internet, any logged-in account will do and someone has to click or visit something.
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.
Rules current as of 5 October 2026.