CVE-2026-64792HighCVSS 7.5CVE published 22 July 2026Added to mySites.guru 22 July 2026

Articles Anywhere (articlesanywhere) below 19.0.0 - SSRF, Stored XSS and Sensitive Data Exposure

Q: Which versions are affected by CVE-2026-64792?

CVE-2026-64792 is covered by 7 rules: Articles Anywhere up to and including 18.0.2; Sourcerer up to and including 12.2.8; Modules Anywhere up to and including 8.4.1; Snippets up to and including 9.3.10; Tabs & Accordions up to and including 2.5.6; ReReplacer up to and including 15.0.3; Conditional Content up to and including 6.0.0.

Q: How do I fix CVE-2026-64792?

It depends on the extension and release line your site runs. For Articles Anywhere up to and including 18.0.2: update Articles Anywhere to 19.0.0 for this flaw, or to 20.1.1 or later, which no rule we check matches. For Sourcerer up to and including 12.2.8: update Sourcerer to 13.0.0 for this flaw, or to 17.0.1 or later, which no rule we check matches. For Modules Anywhere up to and including 8.4.1: update Modules Anywhere to 9.0.0 for this flaw, or to 10.0.0 or later, which no rule we check matches. For Snippets up to and including 9.3.10: update Snippets to the newest release from the vendor. This flaw covers versions up to 9.3.10, so any later release is outside it. For Tabs & Accordions up to and including 2.5.6: update Tabs & Accordions to the newest release from the vendor. This flaw covers versions up to 2.5.6, so any later release is outside it. For ReReplacer up to and including 15.0.3: update ReReplacer to the newest release from the vendor. This flaw covers versions up to 15.0.3, so any later release is outside it. For Conditional Content up to and including 6.0.0: update Conditional Content to the newest release from the vendor. This flaw covers versions up to 6.0.0, so any later release is outside it.

Q: How severe is CVE-2026-64792?

CISA-ADP scores it 7.5 (High) under CVSS 3.1. In plain terms: reachable across the internet, no account needed and nobody has to be tricked into anything.

Regular Labs Articles Anywhere before 19.0.0 is affected by issues fixed in the coordinated Regular Labs security release of 22 July 2026 (no CVE assigned): external image downloads accepting unsafe hosts, redirects, non-image responses or local download folders (SSRF); tag-provided field custom HTML overrides able to render unsafe markup (stored XSS); tag-provided ignore flags able to expose restricted or unpublished content; Smart Search indexing generated output with the indexing administrator access; and user tags, filters and conditions able to expose authentication data. Several fixes are BC breaks (field custom HTML now renders as escaped text). Update to Articles Anywhere 19.0.0 or later. CVE ids assigned by the Joomla CNA for this extension in the 22 July 2026 Regular Labs security release: CVE-2026-64793, CVE-2026-64794, CVE-2026-64795, CVE-2026-64799, CVE-2026-65755.

Is my site affected?

CVE-2026-64792 is checked by 7 rules. Find the extension and release line your site runs:

Extension	Affected versions	Fixed in	What to do
Articles Anywhere	up to and including 18.0.2	update to 19.0.0	Update Articles Anywhere to 19.0.0 for this flaw, or to 20.1.1 or later, which no rule we check matches.
Sourcerer	up to and including 12.2.8	update to 13.0.0	Update Sourcerer to 13.0.0 for this flaw, or to 17.0.1 or later, which no rule we check matches.
Modules Anywhere	up to and including 8.4.1	update to 9.0.0	Update Modules Anywhere to 9.0.0 for this flaw, or to 10.0.0 or later, which no rule we check matches.
Snippets	up to and including 9.3.10	after 9.3.10	Update Snippets to the newest release from the vendor. This flaw covers versions up to 9.3.10, so any later release is outside it.
Tabs & Accordions	up to and including 2.5.6	after 2.5.6	Update Tabs & Accordions to the newest release from the vendor. This flaw covers versions up to 2.5.6, so any later release is outside it.
ReReplacer	up to and including 15.0.3	after 15.0.3	Update ReReplacer to the newest release from the vendor. This flaw covers versions up to 15.0.3, so any later release is outside it.
Conditional Content	up to and including 6.0.0	after 6.0.0	Update Conditional Content to the newest release from the vendor. This flaw covers versions up to 6.0.0, so any later release is outside it.

Check whether your sites are affected

How CVE-2026-64792 is scored

The base metrics as CISA-ADP published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

7.5 High

CVSS 3.1, scored by CISA-ADP

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

How it is reached

AV:N Attack vector: Network. Reachable across the internet
AC:L Attack complexity: Low. Nothing to work around, it just works
PR:N Privileges required: None. No account needed
UI:N User interaction: None. Nobody has to be tricked into anything
S:U Scope: Unchanged. Contained to the extension it is in

What it does

C:H Confidentiality: High. Everything the site holds can be read
I:N Integrity: None. Nothing can be altered
A:N Availability: None. The site stays up

The rule below is rated Critical for the set of 7 CVEs it covers together, not for this record on its own.

Timeline

22 July 2026CVE-2026-64792 record published by its CNA
22 July 2026mySites.guru check added for Articles Anywhere (up to and including 18.0.2)
22 July 2026mySites.guru check added for Sourcerer (up to and including 12.2.8)
22 July 2026mySites.guru check added for Modules Anywhere (up to and including 8.4.1)
22 July 2026mySites.guru check added for Snippets (up to and including 9.3.10)
22 July 2026mySites.guru check added for Tabs & Accordions (up to and including 2.5.6)
22 July 2026mySites.guru check added for ReReplacer (up to and including 15.0.3)
22 July 2026mySites.guru check added for Conditional Content (up to and including 6.0.0)
22 July 2026We published: Regular Labs Patched Its Whole Joomla Extension Catalogue at Once

Rule details

CriticalCVE-2026-64793 CVE-2026-64794 CVE-2026-64795 CVE-2026-64799 CVE-2026-65755 CVE-2026-63265 CVE-2026-647922026-07-22

Articles Anywhere

Affected versions: ≤ 18.0.2

Full advisory: regularlabs.com

CriticalCVE-2025-22204 CVE-2026-74253 CVE-2026-64796 CVE-2026-63265 CVE-2026-647922026-07-22

Sourcerer - Sourcerer (sourcerer) below 13.0.0 - Code Execution (CVE-2025-22204) and PHP/Script Privilege Escalation

Regular Labs Sourcerer is affected by two lines of security issue. (1) CVE-2025-22204: improper control of code generation leading to code execution in versions before 11.0.0. (2) The coordinated Regular Labs security release of 22 July 2026 (Sourcerer 13.0.0) restricts PHP in articles to content created and last modified by Super Users, enforces the configured CSS/JavaScript/PHP permissions across tags, attributes, files and both article creators and modifiers, restricts PHP includes to the configured include folder, and fixes script/style security checks that missed executable tag variants - collectively a set of privilege-escalation and code/markup-execution hardening fixes. No CVE was assigned to the 22 July issues. Update to Sourcerer 13.0.0 or later. Note: 13.0.0 preserves your existing Pro security settings on update, so review them to opt into the new stricter defaults. CVE ids assigned by the Joomla CNA for this extension in the 22 July 2026 Regular Labs security release: CVE-2026-64796. Sites on this version range are ALSO within the affected range of CVE-2026-74253 (Sourcerer before 16.0.0, CVSS 4.0 10.0 Critical, unauthenticated remote code execution through unverified reflected code, CWE-94, credited to Lukasz Rybak), whose CNA record was re-scoped on 26 August 2026 and now covers 1.0.0 to 15.0.0. Updating to 13.0.0 is therefore no longer sufficient, and neither is 14.x or 15.0.0: the vendor fix for CVE-2026-74253 was incomplete twice and only Sourcerer 16.0.0 (26 August 2026) resolves it. Update to 16.0.0 or later. The Joomla Security Strike Team confirmed active exploitation in the wild from around 19 August 2026. If you cannot update immediately, disable the Sourcerer system plugin, which is the plugin that renders Sourcerer tags.

Affected versions: ≤ 12.2.8

Full advisory: regularlabs.com

CriticalCVE-2026-65757 CVE-2026-64793 CVE-2026-64795 CVE-2026-63265 CVE-2026-647922026-07-22

Modules Anywhere - Modules Anywhere (modulesanywhere) below 9.0.0 - Stored XSS, Access Control Bypass and Information Disclosure

Regular Labs Modules Anywhere before 9.0.0 is affected by issues fixed in the coordinated Regular Labs security release of 22 July 2026 (no CVE assigned): tag-provided module content and title overrides able to render unsafe markup (stored XSS); content tags able to bypass module access or publication through unapproved ignore flags or property overrides (access-control bypass); the editor popup exposing module data to unauthorized logged-in users without request token checks (information disclosure); and Smart Search indexing modules visible only to administrators. Several fixes are BC breaks (tag-provided content now renders as escaped text). Update to Modules Anywhere 9.0.0 or later. CVE ids assigned by the Joomla CNA for this extension in the 22 July 2026 Regular Labs security release: CVE-2026-64793, CVE-2026-64795, CVE-2026-65757.

Affected versions: ≤ 8.4.1

Full advisory: regularlabs.com

MediumCVE-2026-63684 CVE-2026-64792 CVE-2026-632652026-07-22

Snippets - Regular Labs Snippets (com_snippets) <= 9.3.10 - Broken Access Control and Search Index Content Disclosure

Regular Labs Snippets up to and including 9.3.10. Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks, so unauthorised backend users or a CSRF attack could expose, create or modify extension configuration and items (CVE-2026-63684). Smart Search indexing could also store restricted content in the public search index (CVE-2026-64792), and the shared Regular Labs AJAX endpoints lacked consistent CSRF and permission checks (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (10.0.0). Note this rule matches the com_snippets component deliberately: the plugin element "snippets" is also used by the unrelated "Page Builder CK - Snippets" plugin.

Affected versions: ≤ 9.3.10

Full advisory: our disclosure post

MediumCVE-2026-64792 CVE-2026-632652026-07-22

Tabs & Accordions - Regular Labs Tabs & Accordions (tabsaccordions) <= 2.5.6 - Access Control and Search Index Content Disclosure

Regular Labs Tabs & Accordions up to and including 2.5.6. Smart Search indexing could render generated content using the indexing administrator identity instead of a public guest, so restricted or administrator-only content could be stored in the public search index and disclosed to visitors (CVE-2026-64792). Also affected by CVE-2026-63265, missing CSRF tokens and permission checks on the shared Regular Labs AJAX endpoints. Fixed in the Regular Labs security release of 22 July 2026 (3.0.0).

Affected versions: ≤ 2.5.6

Full advisory: our disclosure post

MediumCVE-2026-65754 CVE-2026-63684 CVE-2026-63280 CVE-2026-63281 CVE-2026-63265 CVE-2026-64792 CVE-2026-636832026-07-22

ReReplacer - Regular Labs ReReplacer (com_rereplacer) <= 15.0.3 - Path Traversal, Broken Access Control and Stored XSS

Regular Labs ReReplacer up to and including 15.0.3. ReReplacer XML include paths could read files outside the site directory (CVE-2026-65754). Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks (CVE-2026-63684). Via the bundled Conditions component it is also affected by CVE-2026-63280 (missing tokens/permissions in Conditions administration), CVE-2026-63281 (stored XSS in administrator summaries) and CVE-2026-63683 (spoofable IP/GeoIP condition headers), plus CVE-2026-64792 (Smart Search indexing rendering restricted content as the indexing administrator) and CVE-2026-63265 (Regular Labs AJAX endpoints). Fixed in the Regular Labs security release of 22 July 2026 (16.0.0).

Affected versions: ≤ 15.0.3

Full advisory: our disclosure post

MediumCVE-2026-63280 CVE-2026-63281 CVE-2026-63683 CVE-2026-64792 CVE-2026-632652026-07-22

Conditional Content - Regular Labs Conditional Content (conditionalcontent) <= 6.0.0 - Broken Access Control, Stored XSS and GeoIP Rule Bypass

Regular Labs Conditional Content up to and including 6.0.0, via the bundled Conditions component and the shared Regular Labs library. Conditions administration did not consistently enforce tokens and component/mapped-item permissions (CVE-2026-63280); stored condition values could execute HTML/JavaScript in administrator summaries (CVE-2026-63281); IP and GeoIP conditions trusted spoofable forwarded headers (CVE-2026-63683); Smart Search indexing could store restricted content in the public index (CVE-2026-64792); and the Regular Labs AJAX endpoints lacked consistent CSRF and permission checks (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (7.0.0).

Affected versions: ≤ 6.0.0

Full advisory: our disclosure post

Our disclosure post

Regular Labs Patched Its Whole Joomla Extension Catalogue at Once

Regular Labs patched its Joomla extension range on 22 July 2026. The Joomla CNA then published 29 CVEs, four rated 9.8. Every CVE and fixed version.

22 Jul 2026

Other vulnerabilities in Snippets, Articles Anywhere, Tabs & Accordions, ReReplacer, Sourcerer, Conditional Content and Modules Anywhere

Updating for CVE-2026-64792 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extensions.

Snippets

Latest safe version: 11.0.0

CVE-2026-88852 High, from 7.0.0 up to but not including 11.0.0
CVE-2026-63684 Medium, up to and including 9.3.10
CVE-2026-63265 Medium, up to and including 9.3.10