Sourcerer (sourcerer) 13.0.0 to 13.1.1 - Unauthenticated RCE via unverified reflected code

Regular Labs Sourcerer 14.0.0 (17 August 2026) carries a security fix the vendor describes as: "[SECURITY FIX] [BC BREAK] Prevents reflected or otherwise unverified rendered Sourcerer code from executing by default while preserving verified article and Custom module code." Every 13.x release up to and including 13.1.1 is affected; this range starts where the earlier Sourcerer rule stops (that one covers 12.2.8 and below, CVE-2025-22204 plus the 22 July 2026 hardening release). Confirmed by audit on a Joomla 6 test site: in 13.1.1 the plugin sweeps the entire page body at the end of every render and executes any Sourcerer tag it finds, because its security check permits PHP for every position except article content, and PHP is enabled by default. HTML-escaping the payload does not stop it: Sourcerer decodes HTML entities inside its own tags so that code written in a WYSIWYG editor still runs. In 14.0.0 the identical payload is removed instead of executed, because only blocks whose origin can be proven (article content, or a Custom module whose rendered text matches what is stored) are trusted. Exploitation needs attacker text to reach the page without passing Joomla core input filtering, which strips it from ordinary request parameters, so the realistic exposure is a third-party extension that echoes or stores raw input, or content a lower-privileged user can place in a field rendered raw outside the article path. Update to Sourcerer 14.0.0 or later. Note that 14.0.0 is deliberately a BC break: in Free, existing Sourcerer tags generated only during component, module, head or final rendering are removed, and on Pro each unverified CSS, JavaScript or PHP type must now be explicitly allowed, so some legitimate code may stop running until those types are allowed. If you cannot update immediately, disable the Sourcerer system plugin, which is the plugin that renders Sourcerer tags. Assigned CVE-2026-74253 by the Joomla CNA on 17 August 2026 and scored CVSS 4.0 10.0 Critical (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H), CWE-94, credited to Lukasz Rybak. The CNA titles it "Sourcerer < 14.0.0" while its affected range reads 1.0.0-13.1.1; those are the same thing, because no release shipped between 13.1.1 and 14.0.0. Do not rewrite this rule as "below 14.0.0" with a less-than bound: version_compare ranks the PRO suffix below the bare version, so 14.0.0PRO would satisfy it and every Pro customer who installed the fix would be flagged as vulnerable. Pro builds report their version with a PRO suffix (13.1.1PRO), which is why this rule is bounded at the last vulnerable version rather than below the fixed one.

Affected versions: ≥ 12.2.9 and ≤ 13.1.1

Official record: cve.org · NVD

Every connected Joomla site is checked against these rules on each audit, and flagged if it runs an affected version.

Affected extensions and versions