Affected versions: ≥ 7.0.0 and < 8.0.0
Full advisory: regularlabs.com
CVE-2026-85188MediumCVSS 6.9CVE published 14 September 2026Added to mySites.guru 13 September 2026
Conditional Content (conditionalcontent) 7.0.0 to below 8.0.0 - Authenticated PHP Code Execution via Inline Condition Rules
Regular Labs Conditional Content 7.0.0 through 7.1.0 is affected by two vendor-confirmed security defects, both fixed in 8.0.0 (released 13 September 2026). CVE-2026-85192 is the more serious and the most serious item in the whole 13 September batch: untrusted article authors could run PHP through inline Condition Rules. That is arbitrary code execution reachable by the lowest content-authoring role on a Joomla site, which on any site permitting self-registration with authoring rights means an attacker can create that account themselves. 8.0.0 restricts it and is flagged by the vendor as a BC BREAK, so sites legitimately using PHP in Condition Rules must re-authorise the author groups allowed to do so. CVE-2026-85188 is a shared-code defect: the same Condition Set implementation ships in Advanced Module Manager, Conditional Content, Content Templater and ReReplacer, and Regular Labs fixed all four on 13 September 2026. Condition Set labels could be made to reference unrelated database fields, disclosing data the operator was not entitled to read. Exploitation requires administrator access to create or edit a Condition Set, so this is an authenticated information disclosure rather than a remote one. Update to 8.0.0 or later and review who holds content-authoring rights. The CVE records were published on 14 September 2026: CVE-2026-85192 at CVSS 4.0 9.4 (Critical), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H; CVE-2026-85188 at CVSS 4.0 6.9 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N.
Is my site affected?
CVE-2026-85188 is checked by 4 rules. Find the extension and release line your site runs:
| Extension | Affected versions | Fixed in | What to do |
|---|---|---|---|
| Conditional Content | from 7.0.0 up to but not including 8.0.0 | 8.0.0 | Update Conditional Content to 8.0.0 or later. |
| Content Templater | from 14.0.0 up to but not including 14.2.0 | 14.2.0 | Update Content Templater to 14.2.0 or later. |
| Advanced Module Manager | from 12.0.0 up to but not including 12.1.0 | 12.1.0 | Update Advanced Module Manager to 12.1.0 or later. |
| ReReplacer | from 16.0.0 up to but not including 16.2.0 | 16.2.0 | Update ReReplacer to 16.2.0 or later. |
How CVE-2026-85188 is scored
The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.
6.9 Medium
CVSS 4.0, scored by Joomla CNACVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NHow it is reached
- AV:N Attack vector
- Network. Reachable across the internet
- AC:L Attack complexity
- Low. Nothing to work around, it just works
- AT:N Attack requirements
- None. Works against any affected install
- PR:H Privileges required
- High. Needs an account with elevated rights
- UI:N User interaction
- None. Nobody has to be tricked into anything
What it does to the site
- VC:H Confidentiality
- High. Everything the site holds can be read
- VI:N Integrity
- None. Nothing can be altered
- VA:N Availability
- None. The site stays up
What it does beyond the site
- SC:N Confidentiality
- None. Other systems keep their data
- SI:N Integrity
- None. Other systems keep their integrity
- SA:N Availability
- None. Other systems stay up
The rule below is rated Critical for the set of 2 CVEs it covers together, not for this record on its own.
Timeline
- 13 September 2026mySites.guru check added for Conditional Content (from 7.0.0 up to but not including 8.0.0)
- 13 September 2026mySites.guru check added for Content Templater (from 14.0.0 up to but not including 14.2.0)
- 13 September 2026mySites.guru check added for Advanced Module Manager (from 12.0.0 up to but not including 12.1.0)
- 13 September 2026mySites.guru check added for ReReplacer (from 16.0.0 up to but not including 16.2.0)
- 14 September 2026CVE-2026-85188 record published by its CNA
Rule details
Content Templater - Content Templater (contenttemplater) 14.0.0 to below 14.2.0 - Authenticated Information Disclosure via Condition Set Labels
Regular Labs Content Templater 14.0.0 through 14.1.0 is affected by CVE-2026-85188, fixed in 14.2.0 (released 13 September 2026). Condition Set labels could be made to reference unrelated database fields, disclosing data the operator was not entitled to read. The same Condition Set code ships in Advanced Module Manager, Conditional Content, Content Templater and ReReplacer, and Regular Labs fixed all four on 13 September 2026. Exploitation requires administrator access to create or edit a Condition Set, so this is an authenticated information disclosure rather than a remote one. Update to 14.2.0 or later. The same release also adds settings restricting who may save PHP Condition Rules, and fixes Condition Set saves not respecting publication and linked-item edit permissions. The CVE record was published on 14 September 2026 with a CVSS 4.0 base score of 6.9 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N.
Affected versions: ≥ 14.0.0 and < 14.2.0
Full advisory: regularlabs.com
Advanced Module Manager - Advanced Module Manager (advancedmodules) 12.0.0 to below 12.1.0 - Authenticated Information Disclosure via Condition Set Labels
Regular Labs Advanced Module Manager 12.0.0 through 12.0.4 is affected by CVE-2026-85188, fixed in 12.1.0 (released 13 September 2026). CVE-2026-85188 is a shared-code defect: the same Condition Set implementation ships in Advanced Module Manager, Conditional Content, Content Templater and ReReplacer, and Regular Labs fixed all four on 13 September 2026. Condition Set labels could be made to reference unrelated database fields, disclosing data the operator was not entitled to read. Exploitation requires administrator access to create or edit a Condition Set, so this is an authenticated information disclosure rather than a remote one. The same release also adds settings restricting who may save PHP Condition Rules. Update to 12.1.0 or later. The CVE record was published on 14 September 2026 with a CVSS 4.0 base score of 6.9 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N.
Affected versions: ≥ 12.0.0 and < 12.1.0
Full advisory: regularlabs.com
ReReplacer - ReReplacer (rereplacer) 16.0.0 to below 16.2.0 - Authenticated Information Disclosure via Condition Set Labels
Regular Labs ReReplacer 16.0.0 through 16.1.0 is affected by CVE-2026-85188, fixed in 16.2.0 (released 13 September 2026). Condition Set labels could be made to reference unrelated database fields, disclosing data the operator was not entitled to read. The same Condition Set code ships in Advanced Module Manager, Conditional Content, Content Templater and ReReplacer, and Regular Labs fixed all four on 13 September 2026. Exploitation requires administrator access to create or edit a Condition Set, so this is an authenticated information disclosure rather than a remote one. Update to 16.2.0 or later. The same release also adds settings restricting who may save PHP Condition Rules, and fixes Condition Set saves not respecting publication and linked-item edit permissions. The CVE record was published on 14 September 2026 with a CVSS 4.0 base score of 6.9 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N.
Affected versions: ≥ 16.0.0 and < 16.2.0
Full advisory: regularlabs.com
Other vulnerabilities in Content Templater, Advanced Module Manager, ReReplacer, Conditional Content, Advanced Module Manager, Conditional Content, Content Templater and ReReplacer
Updating for CVE-2026-85188 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extensions.
Content Templater
Latest safe version: 14.2.0
- CVE-2026-63684 Medium, up to and including 13.0.0
- CVE-2026-63280 Medium, up to and including 13.0.0
- CVE-2026-63281 Medium, up to and including 13.0.0
- CVE-2026-63683 Medium, up to and including 13.0.0
Advanced Module Manager
Latest safe version: 12.1.0
- CVE-2026-63280 Medium, up to and including 11.0.1
- CVE-2026-63281 Medium, up to and including 11.0.1
- CVE-2026-63683 Medium, up to and including 11.0.1
- CVE-2026-63265 Medium, up to and including 11.0.1
ReReplacer
Latest safe version: 16.2.0
- CVE-2026-65754 Medium, up to and including 15.0.3
- CVE-2026-63684 Medium, up to and including 15.0.3
- CVE-2026-63280 Medium, up to and including 15.0.3
- CVE-2026-63281 Medium, up to and including 15.0.3
Conditional Content
Latest safe version: 8.0.0
- CVE-2026-85192 Critical, from 7.0.0 up to but not including 8.0.0
- CVE-2026-63280 Medium, up to and including 6.0.0
- CVE-2026-63281 Medium, up to and including 6.0.0
- CVE-2026-63683 Medium, up to and including 6.0.0
- CVE-2026-64792 Medium, up to and including 6.0.0
Advanced Module Manager
Latest safe version: 12.1.0
Conditional Content
Latest safe version: 8.0.0
- CVE-2026-85192 Critical, from 7.0.0 up to but not including 8.0.0
Content Templater
Latest safe version: 14.2.0
ReReplacer
Latest safe version: 16.2.0
References
- CVE-2026-85188 on cve.org (the official CVE record)
- CVE-2026-85188 in the NIST National Vulnerability Database
- regularlabs.com/conditionalcontent/download
- regularlabs.com/contenttemplater/download
- regularlabs.com/advancedmodulemanager/download
- regularlabs.com/rereplacer/download
CVE-2026-85188 questions
Which versions are affected by CVE-2026-85188?
CVE-2026-85188 is covered by 4 rules: Conditional Content from 7.0.0 up to but not including 8.0.0; Content Templater from 14.0.0 up to but not including 14.2.0; Advanced Module Manager from 12.0.0 up to but not including 12.1.0; ReReplacer from 16.0.0 up to but not including 16.2.0.
How do I fix CVE-2026-85188?
It depends on the extension and release line your site runs. For Conditional Content from 7.0.0 up to but not including 8.0.0: update Conditional Content to 8.0.0 or later. For Content Templater from 14.0.0 up to but not including 14.2.0: update Content Templater to 14.2.0 or later. For Advanced Module Manager from 12.0.0 up to but not including 12.1.0: update Advanced Module Manager to 12.1.0 or later. For ReReplacer from 16.0.0 up to but not including 16.2.0: update ReReplacer to 16.2.0 or later.
How severe is CVE-2026-85188?
Joomla CNA scores it 6.9 (Medium) under CVSS 4.0. In plain terms: reachable across the internet, needs an account with elevated rights and nobody has to be tricked into anything.
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.
Rules current as of 23 October 2026.