Affected versions: ≥ 7.0.0 and < 8.0.0
Full advisory: regularlabs.com
CVE-2026-85188MediumCVSS 6.9Published 13 September 2026
Conditional Content (conditionalcontent) 7.0.0 to below 8.0.0 - Authenticated PHP Code Execution via Inline Condition Rules
Regular Labs Conditional Content 7.0.0 through 7.1.0 is affected by two vendor-confirmed security defects, both fixed in 8.0.0 (released 13 September 2026). CVE-2026-85192 is the more serious and the most serious item in the whole 13 September batch: untrusted article authors could run PHP through inline Condition Rules. That is arbitrary code execution reachable by the lowest content-authoring role on a Joomla site, which on any site permitting self-registration with authoring rights means an attacker can create that account themselves. 8.0.0 restricts it and is flagged by the vendor as a BC BREAK, so sites legitimately using PHP in Condition Rules must re-authorise the author groups allowed to do so. CVE-2026-85188 is a shared-code defect: the same Condition Set implementation ships in Advanced Module Manager, Conditional Content, Content Templater and ReReplacer, and Regular Labs fixed all four on 13 September 2026. Condition Set labels could be made to reference unrelated database fields, disclosing data the operator was not entitled to read. Exploitation requires administrator access to create or edit a Condition Set, so this is an authenticated information disclosure rather than a remote one. Update to 8.0.0 or later and review who holds content-authoring rights. The CVE records were published on 14 September 2026: CVE-2026-85192 at CVSS 4.0 9.4 (Critical), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H; CVE-2026-85188 at CVSS 4.0 6.9 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N.
Affected versions: ≥ 7.0.0 and < 8.0.0
Official record: cve.org · NVD
Every connected Joomla site is checked against these rules on each audit, and flagged if it runs an affected version.
How CVE-2026-85188 is scored
The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.
6.9 Medium
CVSS 4.0, scored by Joomla CNACVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NHow it is reached
- AV:N Attack vector
- Network. Reachable across the internet
- AC:L Attack complexity
- Low. Nothing to work around, it just works
- AT:N Attack requirements
- None. Works against any affected install
- PR:H Privileges required
- High. Needs an account with elevated rights
- UI:N User interaction
- None. Nobody has to be tricked into anything
What it does to the site
- VC:H Confidentiality
- High. Everything the site holds can be read
- VI:N Integrity
- None. Nothing can be altered
- VA:N Availability
- None. The site stays up
What it does beyond the site
- SC:N Confidentiality
- None. Other systems keep their data
- SI:N Integrity
- None. Other systems keep their integrity
- SA:N Availability
- None. Other systems stay up
The rule below is rated Critical for the set of 2 CVEs it covers together, not for this record on its own.
Affected extensions and versions
Conditional Content - Conditional Content (conditionalcontent) 7.0.0 to below 8.0.0 - Authenticated PHP Code Execution via Inline Condition Rules
Regular Labs Conditional Content 7.0.0 through 7.1.0 is affected by two vendor-confirmed security defects, both fixed in 8.0.0 (released 13 September 2026). CVE-2026-85192 is the more serious and the most serious item in the whole 13 September batch: untrusted article authors could run PHP through inline Condition Rules. That is arbitrary code execution reachable by the lowest content-authoring role on a Joomla site, which on any site permitting self-registration with authoring rights means an attacker can create that account themselves. 8.0.0 restricts it and is flagged by the vendor as a BC BREAK, so sites legitimately using PHP in Condition Rules must re-authorise the author groups allowed to do so. CVE-2026-85188 is a shared-code defect: the same Condition Set implementation ships in Advanced Module Manager, Conditional Content, Content Templater and ReReplacer, and Regular Labs fixed all four on 13 September 2026. Condition Set labels could be made to reference unrelated database fields, disclosing data the operator was not entitled to read. Exploitation requires administrator access to create or edit a Condition Set, so this is an authenticated information disclosure rather than a remote one. Update to 8.0.0 or later and review who holds content-authoring rights. The CVE records were published on 14 September 2026: CVE-2026-85192 at CVSS 4.0 9.4 (Critical), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H; CVE-2026-85188 at CVSS 4.0 6.9 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N.
Affected versions: ≥ 7.0.0 and < 8.0.0
Full advisory: regularlabs.com
Conditional Content - Conditional Content (conditionalcontent) 7.0.0 to below 8.0.0 - Authenticated PHP Code Execution via Inline Condition Rules
Regular Labs Conditional Content 7.0.0 through 7.1.0 is affected by two vendor-confirmed security defects, both fixed in 8.0.0 (released 13 September 2026). CVE-2026-85192 is the more serious and the most serious item in the whole 13 September batch: untrusted article authors could run PHP through inline Condition Rules. That is arbitrary code execution reachable by the lowest content-authoring role on a Joomla site, which on any site permitting self-registration with authoring rights means an attacker can create that account themselves. 8.0.0 restricts it and is flagged by the vendor as a BC BREAK, so sites legitimately using PHP in Condition Rules must re-authorise the author groups allowed to do so. CVE-2026-85188 is a shared-code defect: the same Condition Set implementation ships in Advanced Module Manager, Conditional Content, Content Templater and ReReplacer, and Regular Labs fixed all four on 13 September 2026. Condition Set labels could be made to reference unrelated database fields, disclosing data the operator was not entitled to read. Exploitation requires administrator access to create or edit a Condition Set, so this is an authenticated information disclosure rather than a remote one. Update to 8.0.0 or later and review who holds content-authoring rights. The CVE records were published on 14 September 2026: CVE-2026-85192 at CVSS 4.0 9.4 (Critical), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H; CVE-2026-85188 at CVSS 4.0 6.9 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N.
Affected versions: ≥ 7.0.0 and < 8.0.0
Full advisory: regularlabs.com
Content Templater - Content Templater (contenttemplater) 14.0.0 to below 14.2.0 - Authenticated Information Disclosure via Condition Set Labels
Regular Labs Content Templater 14.0.0 through 14.1.0 is affected by CVE-2026-85188, fixed in 14.2.0 (released 13 September 2026). Condition Set labels could be made to reference unrelated database fields, disclosing data the operator was not entitled to read. The same Condition Set code ships in Advanced Module Manager, Conditional Content, Content Templater and ReReplacer, and Regular Labs fixed all four on 13 September 2026. Exploitation requires administrator access to create or edit a Condition Set, so this is an authenticated information disclosure rather than a remote one. Update to 14.2.0 or later. The same release also adds settings restricting who may save PHP Condition Rules, and fixes Condition Set saves not respecting publication and linked-item edit permissions. The CVE record was published on 14 September 2026 with a CVSS 4.0 base score of 6.9 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N.
Affected versions: ≥ 14.0.0 and < 14.2.0
Full advisory: regularlabs.com
Content Templater - Content Templater (contenttemplater) 14.0.0 to below 14.2.0 - Authenticated Information Disclosure via Condition Set Labels
Regular Labs Content Templater 14.0.0 through 14.1.0 is affected by CVE-2026-85188, fixed in 14.2.0 (released 13 September 2026). Condition Set labels could be made to reference unrelated database fields, disclosing data the operator was not entitled to read. The same Condition Set code ships in Advanced Module Manager, Conditional Content, Content Templater and ReReplacer, and Regular Labs fixed all four on 13 September 2026. Exploitation requires administrator access to create or edit a Condition Set, so this is an authenticated information disclosure rather than a remote one. Update to 14.2.0 or later. The same release also adds settings restricting who may save PHP Condition Rules, and fixes Condition Set saves not respecting publication and linked-item edit permissions. The CVE record was published on 14 September 2026 with a CVSS 4.0 base score of 6.9 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N.
Affected versions: ≥ 14.0.0 and < 14.2.0
Full advisory: regularlabs.com
Content Templater - Content Templater (contenttemplater) 14.0.0 to below 14.2.0 - Authenticated Information Disclosure via Condition Set Labels
Regular Labs Content Templater 14.0.0 through 14.1.0 is affected by CVE-2026-85188, fixed in 14.2.0 (released 13 September 2026). Condition Set labels could be made to reference unrelated database fields, disclosing data the operator was not entitled to read. The same Condition Set code ships in Advanced Module Manager, Conditional Content, Content Templater and ReReplacer, and Regular Labs fixed all four on 13 September 2026. Exploitation requires administrator access to create or edit a Condition Set, so this is an authenticated information disclosure rather than a remote one. Update to 14.2.0 or later. The same release also adds settings restricting who may save PHP Condition Rules, and fixes Condition Set saves not respecting publication and linked-item edit permissions. The CVE record was published on 14 September 2026 with a CVSS 4.0 base score of 6.9 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N.
Affected versions: ≥ 14.0.0 and < 14.2.0
Full advisory: regularlabs.com
Content Templater - Content Templater (contenttemplater) 14.0.0 to below 14.2.0 - Authenticated Information Disclosure via Condition Set Labels
Regular Labs Content Templater 14.0.0 through 14.1.0 is affected by CVE-2026-85188, fixed in 14.2.0 (released 13 September 2026). Condition Set labels could be made to reference unrelated database fields, disclosing data the operator was not entitled to read. The same Condition Set code ships in Advanced Module Manager, Conditional Content, Content Templater and ReReplacer, and Regular Labs fixed all four on 13 September 2026. Exploitation requires administrator access to create or edit a Condition Set, so this is an authenticated information disclosure rather than a remote one. Update to 14.2.0 or later. The same release also adds settings restricting who may save PHP Condition Rules, and fixes Condition Set saves not respecting publication and linked-item edit permissions. The CVE record was published on 14 September 2026 with a CVSS 4.0 base score of 6.9 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N.
Affected versions: ≥ 14.0.0 and < 14.2.0
Full advisory: regularlabs.com
Advanced Module Manager - Advanced Module Manager (advancedmodules) 12.0.0 to below 12.1.0 - Authenticated Information Disclosure via Condition Set Labels
Regular Labs Advanced Module Manager 12.0.0 through 12.0.4 is affected by CVE-2026-85188, fixed in 12.1.0 (released 13 September 2026). CVE-2026-85188 is a shared-code defect: the same Condition Set implementation ships in Advanced Module Manager, Conditional Content, Content Templater and ReReplacer, and Regular Labs fixed all four on 13 September 2026. Condition Set labels could be made to reference unrelated database fields, disclosing data the operator was not entitled to read. Exploitation requires administrator access to create or edit a Condition Set, so this is an authenticated information disclosure rather than a remote one. The same release also adds settings restricting who may save PHP Condition Rules. Update to 12.1.0 or later. The CVE record was published on 14 September 2026 with a CVSS 4.0 base score of 6.9 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N.
Affected versions: ≥ 12.0.0 and < 12.1.0
Full advisory: regularlabs.com
Advanced Module Manager - Advanced Module Manager (advancedmodules) 12.0.0 to below 12.1.0 - Authenticated Information Disclosure via Condition Set Labels
Regular Labs Advanced Module Manager 12.0.0 through 12.0.4 is affected by CVE-2026-85188, fixed in 12.1.0 (released 13 September 2026). CVE-2026-85188 is a shared-code defect: the same Condition Set implementation ships in Advanced Module Manager, Conditional Content, Content Templater and ReReplacer, and Regular Labs fixed all four on 13 September 2026. Condition Set labels could be made to reference unrelated database fields, disclosing data the operator was not entitled to read. Exploitation requires administrator access to create or edit a Condition Set, so this is an authenticated information disclosure rather than a remote one. The same release also adds settings restricting who may save PHP Condition Rules. Update to 12.1.0 or later. The CVE record was published on 14 September 2026 with a CVSS 4.0 base score of 6.9 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N.
Affected versions: ≥ 12.0.0 and < 12.1.0
Full advisory: regularlabs.com
Advanced Module Manager - Advanced Module Manager (advancedmodules) 12.0.0 to below 12.1.0 - Authenticated Information Disclosure via Condition Set Labels
Regular Labs Advanced Module Manager 12.0.0 through 12.0.4 is affected by CVE-2026-85188, fixed in 12.1.0 (released 13 September 2026). CVE-2026-85188 is a shared-code defect: the same Condition Set implementation ships in Advanced Module Manager, Conditional Content, Content Templater and ReReplacer, and Regular Labs fixed all four on 13 September 2026. Condition Set labels could be made to reference unrelated database fields, disclosing data the operator was not entitled to read. Exploitation requires administrator access to create or edit a Condition Set, so this is an authenticated information disclosure rather than a remote one. The same release also adds settings restricting who may save PHP Condition Rules. Update to 12.1.0 or later. The CVE record was published on 14 September 2026 with a CVSS 4.0 base score of 6.9 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N.
Affected versions: ≥ 12.0.0 and < 12.1.0
Full advisory: regularlabs.com
ReReplacer - ReReplacer (rereplacer) 16.0.0 to below 16.2.0 - Authenticated Information Disclosure via Condition Set Labels
Regular Labs ReReplacer 16.0.0 through 16.1.0 is affected by CVE-2026-85188, fixed in 16.2.0 (released 13 September 2026). Condition Set labels could be made to reference unrelated database fields, disclosing data the operator was not entitled to read. The same Condition Set code ships in Advanced Module Manager, Conditional Content, Content Templater and ReReplacer, and Regular Labs fixed all four on 13 September 2026. Exploitation requires administrator access to create or edit a Condition Set, so this is an authenticated information disclosure rather than a remote one. Update to 16.2.0 or later. The same release also adds settings restricting who may save PHP Condition Rules, and fixes Condition Set saves not respecting publication and linked-item edit permissions. The CVE record was published on 14 September 2026 with a CVSS 4.0 base score of 6.9 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N.
Affected versions: ≥ 16.0.0 and < 16.2.0
Full advisory: regularlabs.com
ReReplacer - ReReplacer (rereplacer) 16.0.0 to below 16.2.0 - Authenticated Information Disclosure via Condition Set Labels
Regular Labs ReReplacer 16.0.0 through 16.1.0 is affected by CVE-2026-85188, fixed in 16.2.0 (released 13 September 2026). Condition Set labels could be made to reference unrelated database fields, disclosing data the operator was not entitled to read. The same Condition Set code ships in Advanced Module Manager, Conditional Content, Content Templater and ReReplacer, and Regular Labs fixed all four on 13 September 2026. Exploitation requires administrator access to create or edit a Condition Set, so this is an authenticated information disclosure rather than a remote one. Update to 16.2.0 or later. The same release also adds settings restricting who may save PHP Condition Rules, and fixes Condition Set saves not respecting publication and linked-item edit permissions. The CVE record was published on 14 September 2026 with a CVSS 4.0 base score of 6.9 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N.
Affected versions: ≥ 16.0.0 and < 16.2.0
Full advisory: regularlabs.com
ReReplacer - ReReplacer (rereplacer) 16.0.0 to below 16.2.0 - Authenticated Information Disclosure via Condition Set Labels
Regular Labs ReReplacer 16.0.0 through 16.1.0 is affected by CVE-2026-85188, fixed in 16.2.0 (released 13 September 2026). Condition Set labels could be made to reference unrelated database fields, disclosing data the operator was not entitled to read. The same Condition Set code ships in Advanced Module Manager, Conditional Content, Content Templater and ReReplacer, and Regular Labs fixed all four on 13 September 2026. Exploitation requires administrator access to create or edit a Condition Set, so this is an authenticated information disclosure rather than a remote one. Update to 16.2.0 or later. The same release also adds settings restricting who may save PHP Condition Rules, and fixes Condition Set saves not respecting publication and linked-item edit permissions. The CVE record was published on 14 September 2026 with a CVSS 4.0 base score of 6.9 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N.
Affected versions: ≥ 16.0.0 and < 16.2.0
Full advisory: regularlabs.com
Advanced Module Manager - Advanced Module Manager (advancedmodules) 12.0.0 to below 12.1.0 - Authenticated Information Disclosure via Condition Set Labels
Regular Labs Advanced Module Manager 12.0.0 through 12.0.4 is affected by CVE-2026-85188, fixed in 12.1.0 (released 13 September 2026). CVE-2026-85188 is a shared-code defect: the same Condition Set implementation ships in Advanced Module Manager, Conditional Content, Content Templater and ReReplacer, and Regular Labs fixed all four on 13 September 2026. Condition Set labels could be made to reference unrelated database fields, disclosing data the operator was not entitled to read. Exploitation requires administrator access to create or edit a Condition Set, so this is an authenticated information disclosure rather than a remote one. The same release also adds settings restricting who may save PHP Condition Rules. Update to 12.1.0 or later. The CVE record was published on 14 September 2026 with a CVSS 4.0 base score of 6.9 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N.
Affected versions: ≥ 12.0.0 and < 12.1.0
Full advisory: regularlabs.com
Content Templater - Content Templater (contenttemplater) 14.0.0 to below 14.2.0 - Authenticated Information Disclosure via Condition Set Labels
Regular Labs Content Templater 14.0.0 through 14.1.0 is affected by CVE-2026-85188, fixed in 14.2.0 (released 13 September 2026). Condition Set labels could be made to reference unrelated database fields, disclosing data the operator was not entitled to read. The same Condition Set code ships in Advanced Module Manager, Conditional Content, Content Templater and ReReplacer, and Regular Labs fixed all four on 13 September 2026. Exploitation requires administrator access to create or edit a Condition Set, so this is an authenticated information disclosure rather than a remote one. Update to 14.2.0 or later. The same release also adds settings restricting who may save PHP Condition Rules, and fixes Condition Set saves not respecting publication and linked-item edit permissions. The CVE record was published on 14 September 2026 with a CVSS 4.0 base score of 6.9 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N.
Affected versions: ≥ 14.0.0 and < 14.2.0
Full advisory: regularlabs.com
ReReplacer - ReReplacer (rereplacer) 16.0.0 to below 16.2.0 - Authenticated Information Disclosure via Condition Set Labels
Regular Labs ReReplacer 16.0.0 through 16.1.0 is affected by CVE-2026-85188, fixed in 16.2.0 (released 13 September 2026). Condition Set labels could be made to reference unrelated database fields, disclosing data the operator was not entitled to read. The same Condition Set code ships in Advanced Module Manager, Conditional Content, Content Templater and ReReplacer, and Regular Labs fixed all four on 13 September 2026. Exploitation requires administrator access to create or edit a Condition Set, so this is an authenticated information disclosure rather than a remote one. Update to 16.2.0 or later. The same release also adds settings restricting who may save PHP Condition Rules, and fixes Condition Set saves not respecting publication and linked-item edit permissions. The CVE record was published on 14 September 2026 with a CVSS 4.0 base score of 6.9 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N.
Affected versions: ≥ 16.0.0 and < 16.2.0
Full advisory: regularlabs.com
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
Rules current as of 3 October 2026.