Regular Labs Extensions CVE-2026-63265

Requires that the target Joomla site has at least one of the 23 affected Regular Labs extensions installed and active. For the direct privilege escalation path: the attacker must hold a valid Joomla account with at least registered or author-level access (PR:L). For the CSRF path: an authenticated Joomla user (any privilege level, including administrator) must visit an attacker-controlled page while their Joomla session is active (UI:R). Exploitation is limited by the Joomla extension being installed (non-default, optional software), the need for an active authenticated session, and the absence of compensating controls such as SameSite cookies or a WAF blocking cross-origin requests to the AJAX endpoint.

The CVSS 8.0 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) reflects two overlapping attack paths: direct endpoint abuse by an authenticated low-privileged Joomla user (PR:L), and CSRF-driven abuse requiring a victim interaction (UI:R). The combination of C:H/I:H/A:H is defensible given the breadth of affected extensions - DB Replacer and Cache Cleaner can cause data loss, while Articles Anywhere and Modules Anywhere can exfiltrate content. SSVC Technical Impact is rated 'total,' consistent with these high-impact operations. However, SSVC Exploitation is 'none' and Automatable is 'no,' aligning with UI:R and the low EPSS of 0.13% (3rd percentile), meaning this is not a remotely spray-able flaw and has seen no confirmed exploitation. Real-world risk is moderate-to-high for Joomla deployments running Regular Labs extensions but is contingent on attacker ability to trick an authenticated administrator or leverage a lower-privileged account. No conflict exists between the CVSS vector and the description.

An attacker who controls a malicious webpage lures an authenticated Joomla administrator or editor into visiting it. The page silently issues JavaScript-driven AJAX POST requests to the victim site's Regular Labs endpoint (e.g., index.php?option=com_ajax&plugin=regularlabs&format=json&task=...) without a valid CSRF token; because token validation is not consistently enforced, the server processes the request and executes a privileged mutation such as purging the cache, replacing database content, or retrieving access-controlled article data. No public proof-of-concept code is known at the time of analysis.