Affected versions: ≤ 9.3.10
Full advisory: our disclosure post
CVE-2026-63684HighCVSS 8.8CVE published 22 July 2026Added to mySites.guru 22 July 2026
Regular Labs Snippets (com_snippets) <= 9.3.10 - Broken Access Control and Search Index Content Disclosure
Regular Labs Snippets up to and including 9.3.10. Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks, so unauthorised backend users or a CSRF attack could expose, create or modify extension configuration and items (CVE-2026-63684). Smart Search indexing could also store restricted content in the public search index (CVE-2026-64792), and the shared Regular Labs AJAX endpoints lacked consistent CSRF and permission checks (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (10.0.0). Note this rule matches the com_snippets component deliberately: the plugin element "snippets" is also used by the unrelated "Page Builder CK - Snippets" plugin.
Is my site affected?
CVE-2026-63684 is checked by 3 rules. Find the extension and release line your site runs:
| Extension | Affected versions | Fixed in | What to do |
|---|---|---|---|
| Snippets | up to and including 9.3.10 | after 9.3.10 | Update Snippets to the newest release from the vendor. This flaw covers versions up to 9.3.10, so any later release is outside it. |
| Content Templater | up to and including 13.0.0 | after 13.0.0 | Update Content Templater to the newest release from the vendor. This flaw covers versions up to 13.0.0, so any later release is outside it. |
| ReReplacer | up to and including 15.0.3 | after 15.0.3 | Update ReReplacer to the newest release from the vendor. This flaw covers versions up to 15.0.3, so any later release is outside it. |
How CVE-2026-63684 is scored
The base metrics as CISA-ADP published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.
8.8 High
CVSS 3.1, scored by CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HHow it is reached
- AV:N Attack vector
- Network. Reachable across the internet
- AC:L Attack complexity
- Low. Nothing to work around, it just works
- PR:N Privileges required
- None. No account needed
- UI:R User interaction
- Required. Someone has to click or visit something
- S:U Scope
- Unchanged. Contained to the extension it is in
What it does
- C:H Confidentiality
- High. Everything the site holds can be read
- I:H Integrity
- High. Data and files can be altered at will
- A:H Availability
- High. The site can be taken down
The rule below is rated Medium for the set of 3 CVEs it covers together, not for this record on its own.
Timeline
- 22 July 2026CVE-2026-63684 record published by its CNA
- 22 July 2026mySites.guru check added for Snippets (up to and including 9.3.10)
- 22 July 2026mySites.guru check added for Content Templater (up to and including 13.0.0)
- 22 July 2026mySites.guru check added for ReReplacer (up to and including 15.0.3)
- 22 July 2026We published: Regular Labs Patched Its Whole Joomla Extension Catalogue at Once
Rule details
Content Templater - Regular Labs Content Templater (com_contenttemplater) <= 13.0.0 - Broken Access Control and Stored XSS
Regular Labs Content Templater up to and including 13.0.0. Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks (CVE-2026-63684). Via the bundled Conditions component it is also affected by CVE-2026-63280 (missing tokens/permissions in Conditions administration), CVE-2026-63281 (stored XSS in administrator summaries) and CVE-2026-63683 (spoofable IP/GeoIP condition headers), plus CVE-2026-63265 (Regular Labs AJAX endpoints). Fixed in the Regular Labs security release of 22 July 2026 (14.0.0).
Affected versions: ≤ 13.0.0
Full advisory: our disclosure post
ReReplacer - Regular Labs ReReplacer (com_rereplacer) <= 15.0.3 - Path Traversal, Broken Access Control and Stored XSS
Regular Labs ReReplacer up to and including 15.0.3. ReReplacer XML include paths could read files outside the site directory (CVE-2026-65754). Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks (CVE-2026-63684). Via the bundled Conditions component it is also affected by CVE-2026-63280 (missing tokens/permissions in Conditions administration), CVE-2026-63281 (stored XSS in administrator summaries) and CVE-2026-63683 (spoofable IP/GeoIP condition headers), plus CVE-2026-64792 (Smart Search indexing rendering restricted content as the indexing administrator) and CVE-2026-63265 (Regular Labs AJAX endpoints). Fixed in the Regular Labs security release of 22 July 2026 (16.0.0).
Affected versions: ≤ 15.0.3
Full advisory: our disclosure post
Our disclosure post
Other vulnerabilities in Snippets, Content Templater and ReReplacer
Updating for CVE-2026-63684 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extensions.
Snippets
Latest safe version: 11.0.0
- CVE-2026-88852 High, from 10.0.0 up to but not including 11.0.0
- CVE-2026-64792 Medium, up to and including 9.3.10
- CVE-2026-63265 Medium, up to and including 9.3.10
Content Templater
Latest safe version: 14.2.0
- CVE-2026-85188 Medium, from 14.0.0 up to but not including 14.2.0
- CVE-2026-63280 Medium, up to and including 13.0.0
- CVE-2026-63281 Medium, up to and including 13.0.0
- CVE-2026-63683 Medium, up to and including 13.0.0
ReReplacer
Latest safe version: 16.2.0
- CVE-2026-85188 Medium, from 16.0.0 up to but not including 16.2.0
- CVE-2026-65754 Medium, up to and including 15.0.3
- CVE-2026-63280 Medium, up to and including 15.0.3
- CVE-2026-63281 Medium, up to and including 15.0.3
References
- CVE-2026-63684 on cve.org (the official CVE record)
- CVE-2026-63684 in the NIST National Vulnerability Database
- Regular Labs Patched Its Whole Joomla Extension Catalogue at Once
CVE-2026-63684 questions
Which versions are affected by CVE-2026-63684?
CVE-2026-63684 is covered by 3 rules: Snippets up to and including 9.3.10; Content Templater up to and including 13.0.0; ReReplacer up to and including 15.0.3.
How do I fix CVE-2026-63684?
It depends on the extension and release line your site runs. For Snippets up to and including 9.3.10: update Snippets to the newest release from the vendor. This flaw covers versions up to 9.3.10, so any later release is outside it. For Content Templater up to and including 13.0.0: update Content Templater to the newest release from the vendor. This flaw covers versions up to 13.0.0, so any later release is outside it. For ReReplacer up to and including 15.0.3: update ReReplacer to the newest release from the vendor. This flaw covers versions up to 15.0.3, so any later release is outside it.
How severe is CVE-2026-63684?
CISA-ADP scores it 8.8 (High) under CVSS 3.1. In plain terms: reachable across the internet, no account needed and someone has to click or visit something.
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.
Rules current as of 5 October 2026.