Advanced Module Manager (advancedmodules) 12.0.0 to below 12.1.0 - Authenticated Information Disclosure via Condition Set Labels
Regular Labs Advanced Module Manager 12.0.0 through 12.0.4 is affected by CVE-2026-85188, fixed in 12.1.0 (released 13 September 2026). CVE-2026-85188 is a shared-code defect: the same Condition Set implementation ships in Advanced Module Manager, Conditional Content, Content Templater and ReReplacer, and Regular Labs fixed all four on 13 September 2026. Condition Set labels could be made to reference unrelated database fields, disclosing data the operator was not entitled to read. Exploitation requires administrator access to create or edit a Condition Set, so this is an authenticated information disclosure rather than a remote one. The same release also adds settings restricting who may save PHP Condition Rules. Update to 12.1.0 or later. As at 13 September 2026 the CVE record(s) for this advisory are RESERVED and not yet published, so no official CVSS score exists yet and the severity recorded here is mySites.guru's own assessment, to be revised when the records go live.
Affected versions: ≥ 12.0.0 and < 12.1.0
Full advisory: regularlabs.com
Advanced Module Manager (advancedmodules) 12.0.0 to below 12.1.0 - Authenticated Information Disclosure via Condition Set Labels
Regular Labs Advanced Module Manager 12.0.0 through 12.0.4 is affected by CVE-2026-85188, fixed in 12.1.0 (released 13 September 2026). CVE-2026-85188 is a shared-code defect: the same Condition Set implementation ships in Advanced Module Manager, Conditional Content, Content Templater and ReReplacer, and Regular Labs fixed all four on 13 September 2026. Condition Set labels could be made to reference unrelated database fields, disclosing data the operator was not entitled to read. Exploitation requires administrator access to create or edit a Condition Set, so this is an authenticated information disclosure rather than a remote one. The same release also adds settings restricting who may save PHP Condition Rules. Update to 12.1.0 or later. As at 13 September 2026 the CVE record(s) for this advisory are RESERVED and not yet published, so no official CVSS score exists yet and the severity recorded here is mySites.guru's own assessment, to be revised when the records go live.
Affected versions: ≥ 12.0.0 and < 12.1.0
Full advisory: regularlabs.com
Advanced Module Manager (advancedmodules) 12.0.0 to below 12.1.0 - Authenticated Information Disclosure via Condition Set Labels
Regular Labs Advanced Module Manager 12.0.0 through 12.0.4 is affected by CVE-2026-85188, fixed in 12.1.0 (released 13 September 2026). CVE-2026-85188 is a shared-code defect: the same Condition Set implementation ships in Advanced Module Manager, Conditional Content, Content Templater and ReReplacer, and Regular Labs fixed all four on 13 September 2026. Condition Set labels could be made to reference unrelated database fields, disclosing data the operator was not entitled to read. Exploitation requires administrator access to create or edit a Condition Set, so this is an authenticated information disclosure rather than a remote one. The same release also adds settings restricting who may save PHP Condition Rules. Update to 12.1.0 or later. As at 13 September 2026 the CVE record(s) for this advisory are RESERVED and not yet published, so no official CVSS score exists yet and the severity recorded here is mySites.guru's own assessment, to be revised when the records go live.
Affected versions: ≥ 12.0.0 and < 12.1.0
Full advisory: regularlabs.com
Regular Labs Advanced Module Manager (com_advancedmodules) <= 11.0.1 - Broken Access Control, Stored XSS and GeoIP Rule Bypass
Regular Labs Advanced Module Manager up to and including 11.0.1, via the bundled Conditions component and the shared Regular Labs library. Conditions administration did not consistently enforce tokens and component/mapped-item permissions (CVE-2026-63280); stored condition values could execute HTML/JavaScript in administrator summaries (CVE-2026-63281); IP and GeoIP conditions trusted spoofable forwarded headers, letting a remote client bypass location-based display rules (CVE-2026-63683); and privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens or matching permissions (CVE-2026-63265). Fixed in the Regular Labs security release of 22 July 2026 (12.0.0).
Affected versions: ≤ 11.0.1
Full advisory: our disclosure post
Running Advanced Module Manager on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
CVE identifiers: CVE-2026-85188, CVE-2026-63280, CVE-2026-63281, CVE-2026-63683, CVE-2026-63265. Rules current as of 13 September 2026.