PHP Code Injection Vulnerability in Joomla Extension by Regular Labs

CVE-2026-102802

What is CVE-2026-102802?

The Sourcerer extension for Joomla by Regular Labs contains a PHP code injection vulnerability due to improper handling of article author trust levels in conjunction with the Articles Anywhere extension. Under specific conditions, when Articles Anywhere processes inclusions before Sourcerer, the PHP code from an included article can unintentionally execute within the context of the enclosing article's trusted identity. This flaw arises when Force Content Triggers is disabled, allowing for a potential misuse of authority, where the permissions for execution may not align with the original content creator's intentions.

References