Sourcerer CVE-2026-102802

Requires all of the following together: Sourcerer (Free or Pro) before 17.0.1 AND Articles Anywhere before 20.1.1 both installed; an article authored by a low-trust identity that contains Sourcerer PHP code; that article being included into a more-trusted article via Articles Anywhere; the inclusion being processed before Sourcerer; and the 'Force Content Triggers' option being OFF. Strong limiting factors apply: the attacker needs authenticated privileges to create or author article content, the specific two-extension combination at vulnerable versions must be present, and the non-default processing/configuration (Force Content Triggers off, inclusion-before-Sourcerer ordering - reflected as AT:P) must hold. Ordinary Articles Anywhere output is not affected; only the identity-confusion path, where the authority of the article supplying the code differs from the authority used to decide whether to run it, is exploitable.

The supplied CVSS 4.0 base score of 8.9 reflects high confidentiality, integrity and availability impact on both the vulnerable and the subsequent system, consistent with a CWE-94 PHP code-injection flaw that yields server-side code execution. Several signals temper real-world urgency, however: the vector requires PR:H (privileged, authenticated access) and AT:P (a specific attack requirement/condition must be present), and the vuln.today decision label is 'this_week' - not act_now or emergency. No EPSS score is provided, the CVE is not listed in CISA KEV, and no public exploit or PoC reference is present (the only reference is the generic regularlabs.com homepage), so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical gating factors are substantial: exploitation needs BOTH the Sourcerer and Articles Anywhere extensions installed at vulnerable versions, the non-default processing order (Articles Anywhere processing the inclusion before Sourcerer), and the 'Force Content Triggers' option turned off. This is therefore a genuinely high-severity code-injection issue that warrants prompt patching this week for sites running this specific extension combination, but it is not a mass-exploitable, unauthenticated, internet-facing bug. Note: the input supplies a CVSS 4.0 vector only - no CVSS 3.1 vector, EPSS, KEV or explicit SSVC fields - so exploitation-probability and automatability are inferred from the 4.0 vector rather than confirmed.

An attacker holding a low-trust Joomla content role (for example an author who is not permitted to run PHP) authors an article containing Sourcerer PHP code. When a more-trusted article includes that article via Articles Anywhere - with the inclusion processed before Sourcerer and Force Content Triggers disabled - the included code is evaluated under the enclosing article's trusted identity, producing arbitrary PHP execution on the server. No public PoC or exploit code is identified at time of analysis.