External risk intelligence

Joomla Sourcerer Extension Code Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-64796

The vulnerability exists in a Joomla extension, which is a component of a web application. Web applications and their associated extensions are commonly deployed as internet-facing services, making them reachable via standard web traffic.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in a widely used Joomla extension could allow unauthorized code execution, potentially impacting websites that utilize this component. The issue involves multiple vectors that could enable attackers to inject and run malicious code, posing a risk to the integrity and availability of affected sites. Understanding the potential exposure is the primary leadership concern at this time.

Allows code injection and execution.
Impacts website integrity and availability.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by submitting specially crafted content to a Joomla website that uses the affected extension. Because the vulnerability involves unauthenticated code injection, an attacker does not need any special access to the website to trigger it. Successful exploitation could allow an attacker to execute arbitrary PHP code, modify website content, or disrupt website operations.

No authentication required to exploit.
Submit malicious content to vulnerable component.
Arbitrary code execution, content modification, denial of service.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Sourcerer extension could allow unauthorized code execution due to insufficient checks on user roles and permission enforcement. When supported by the advisory, this could impact the integrity of the Joomla site and its hosted content.

Joomla site integrity.
Code injection via improper validation.
Unauthorized code execution risks.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Joomla Sourcerer extension by regularlabs.com affects PHP code execution and could lead to critical impacts. The first step is to identify all instances of the affected extension, determine their reachability and business criticality, and then assign ownership for remediation planning.

Application owners and platform teams should own the issue.
Verify extension installation and reachability.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Sourcerer extension for Joomla?

Sourcerer is a plugin developed by Regular Labs that allows users to embed custom code, such as PHP, HTML, CSS, and JavaScript, directly into Joomla articles and modules. It acts as a bridge that bypasses the standard Joomla editor restrictions, which typically strip out executable scripts for security reasons. By enabling this functionality, administrators can include dynamic content directly within their site's CMS-managed pages.

How does CVE-2026-64796 create a security risk?

This vulnerability is classified as Improper Access Control (CWE-284). It occurs because the extension fails to correctly verify user permissions or enforce intended security boundaries. Instead of restricting code execution to authorized administrative users, the plugin allows unauthorized or less-privileged parties to inject and run arbitrary PHP code. This effectively turns a site-management tool into a pathway for executing unauthorized commands on the server.

Do I need to be logged into the site to trigger this flaw?

No. The vulnerability does not require an attacker to have a valid account or special administrative privileges. The issue lies in how the extension processes content inputs; therefore, simply submitting a specially crafted request or content payload to the website can be enough to trigger the execution. It is not limited to actions performed by existing backend users.

Is my website at risk if it runs the Sourcerer extension?

According to Halo Surface Signal, this extension is a component of a web application and is frequently deployed in internet-facing environments. Because these sites are reachable via standard web traffic, they are accessible to remote actors. If your instance is exposed to the public internet, it faces a higher probability of being reached by automated probes seeking to exploit this specific vulnerability.

How should I respond to this vulnerability?

Start by conducting an inventory to confirm where Sourcerer is installed across your Joomla environments. Evaluate the reachability of each instance and identify the business owners responsible for those sites. Since this vulnerability involves improper permission enforcement, prioritize reviewing access logs for signs of unauthorized activity while you coordinate with your application teams to plan for necessary patches or removal of the extension.

References

regularlabs.com/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.