Sourcerer security vulnerabilities

mySites.guru tracks 2vulnerabilities in sourcerer. Every connected Joomla site is checked against them on each audit, and flagged if it runs an affected version.

Check whether your sites are affected

What we check for

CriticalCVE-2026-742532026-08-17

Sourcerer (sourcerer) 13.0.0 to 13.1.1 - Unauthenticated RCE via unverified reflected code (CVE-2026-74253, CVSS 10.0)

Affected versions: ≥ 12.2.9 and ≤ 13.1.1

CriticalCVE-2025-22204 CVE-2026-74253

Sourcerer (sourcerer) below 13.0.0 - Code Execution (CVE-2025-22204) and PHP/Script Privilege Escalation

Affected versions: ≤ 12.2.8

What we have written about Sourcerer

Sourcerer 14.0.0 fixes PHP execution from unverified content

Sourcerer, the Joomla extension, ran PHP from page content it could not trace to a verified source. CVE-2026-74253 scores 10.0 critical. Update to 14.0.0.

17 Aug 2026

Running Sourcerer on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

CVE identifiers: CVE-2026-74253, CVE-2025-22204. Rules current as of 24 August 2026.