Joomla Users Anywhere CVE-2026-64794

The attacker must have an authenticated Joomla account with permissions to create or edit content that can include user tags (e.g., articles, modules, or custom HTML). The website must be running a vulnerable version of the Users Anywhere or Articles Anywhere extension (versions as listed in affected_products) and the extension must be enabled. The attack leverages the user tags, filters, and conditions feature provided by these extensions; if this feature is disabled or not used on the site, the vulnerability cannot be exploited. The CVSS vector confirms low privileges are required (PR:L) and no user interaction is needed (UI:N), meaning the attacker can trigger the disclosure directly through content submission.

The vulnerability carries a CVSS 3.1 base score of 6.5 (Medium) with high confidentiality impact but no integrity or availability impact. The EPSS score is 0.23% (percentile 14%), indicating very low exploitation probability in the wild. No mention of CISA KEV inclusion or public exploit code was found in the provided data. The attack requires an authenticated Joomla account, which limits exploitation to users with at least content creation privileges, reducing the overall risk for sites with strict user registration controls. However, for sites allowing self-registration and content publishing, the risk is moderate. No active exploitation is confirmed, making this a lower urgent priority unless the extensions are widely deployed in sensitive environments.

An attacker with a registered Joomla account (low privileges) creates a new article or module containing a specially crafted user tag that requests raw user parameters, such as password hashes. When the content is rendered, the vulnerable extension processes the tag without proper access checks, exposing the sensitive data to the attacker. The attack does not require user interaction and can be automated if the attacker can create content without manual review.