Skip to main content
mySites.guru
Free Audit
CriticalA PHP security release fixes two CVSS 9.2 flaws, and PHP 8.1 and older get no patchWhat it means for your site

ReReplacer security vulnerabilities

mySites.guru tracks 2 vulnerabilities in ReReplacer (com_rereplacer), covering 5 CVEs. Every connected Joomla site is checked against them on each audit.

Is my site affected?

Your site is affected if it runs ReReplacer in any of these ranges:

  • from 16.0.0 up to but not including 16.2.0
  • up to and including 15.0.3
Latest safe version
16.2.0 or later. No rule we check matches that release or any newer one.
What to do
Update ReReplacer to 16.2.0 or later from the vendor, then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
Check whether your sites are affected

Every ReReplacer vulnerability we track

Newest first. CVSS is the score published in each CVE record, where it has one; the severity column is the rating our check uses.

CVEAffected versionsFixed inSeverityAdded
CVE-2026-85188CVSS 6.9from 16.0.0 up to but not including 16.2.016.2.0Medium2026-09-13
CVE-2026-65754CVSS 7.5CVE-2026-63684CVSS 8.8CVE-2026-63280CVSS 8.8CVE-2026-63281CVSS 4.8up to and including 15.0.3after 15.0.3Medium2026-07-22

What we check for

MediumCVE-2026-851882026-09-13

ReReplacer (rereplacer) 16.0.0 to below 16.2.0 - Authenticated Information Disclosure via Condition Set Labels

Regular Labs ReReplacer 16.0.0 through 16.1.0 is affected by CVE-2026-85188, fixed in 16.2.0 (released 13 September 2026). Condition Set labels could be made to reference unrelated database fields, disclosing data the operator was not entitled to read. The same Condition Set code ships in Advanced Module Manager, Conditional Content, Content Templater and ReReplacer, and Regular Labs fixed all four on 13 September 2026. Exploitation requires administrator access to create or edit a Condition Set, so this is an authenticated information disclosure rather than a remote one. Update to 16.2.0 or later. The same release also adds settings restricting who may save PHP Condition Rules, and fixes Condition Set saves not respecting publication and linked-item edit permissions. The CVE record was published on 14 September 2026 with a CVSS 4.0 base score of 6.9 (Medium), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N.

Affected versions: ≥ 16.0.0 and < 16.2.0

Full advisory: regularlabs.com

MediumCVE-2026-65754CVE-2026-63684CVE-2026-63280CVE-2026-632812026-07-22

Regular Labs ReReplacer (com_rereplacer) <= 15.0.3 - Path Traversal, Broken Access Control and Stored XSS

Regular Labs ReReplacer up to and including 15.0.3. ReReplacer XML include paths could read files outside the site directory (CVE-2026-65754). Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks (CVE-2026-63684). Via the bundled Conditions component it is also affected by CVE-2026-63280 (missing tokens/permissions in Conditions administration), CVE-2026-63281 (stored XSS in administrator summaries) and CVE-2026-63683 (spoofable IP/GeoIP condition headers), plus CVE-2026-64792 (Smart Search indexing rendering restricted content as the indexing administrator) and CVE-2026-63265 (Regular Labs AJAX endpoints). Fixed in the Regular Labs security release of 22 July 2026 (16.0.0).

Affected versions: ≤ 15.0.3

Full advisory: our disclosure post

Timeline

  1. 22 July 2026Check added for CVE-2026-65754, CVE-2026-63684, CVE-2026-63280 and CVE-2026-63281 (up to and including 15.0.3)
  2. 22 July 2026CVE-2026-63684 record published
  3. 22 July 2026CVE-2026-63280 record published
  4. 22 July 2026CVE-2026-63281 record published
  5. 23 July 2026CVE-2026-65754 record published
  6. 13 September 2026Check added for CVE-2026-85188 (from 16.0.0 up to but not including 16.2.0)
  7. 14 September 2026CVE-2026-85188 record published

References

Each CVE page above links its official cve.org record and its NVD entry.

ReReplacer vulnerability questions

Which versions of ReReplacer are vulnerable?
mySites.guru tracks 2 vulnerabilities in ReReplacer (com_rereplacer). A site is affected if its installed version is in any of these ranges: from 16.0.0 up to but not including 16.2.0; up to and including 15.0.3.
What is the latest safe version of ReReplacer?
16.2.0. Every vulnerability tracked here is fixed by 16.2.0, and no rule we check matches that release or any later one.
How do I check which version of ReReplacer my Joomla site runs?
The installed version is listed on the Joomla administrator's Extensions: Manage screen; search it for com_rereplacer. mySites.guru reads the installed version on every audit of a connected site and checks it against these rules.

Running ReReplacer on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.

CVE identifiers: CVE-2026-85188, CVE-2026-65754, CVE-2026-63684, CVE-2026-63280, CVE-2026-63281. Rules current as of 23 October 2026.