Regular Labs Sourcerer CVE-2026-74253

Exploitation requires that the target Joomla site have the Regular Labs Sourcerer plugin (version < 14.0.0) installed and enabled, AND that attacker-supplied input be reflected into the final rendered HTML of a page that Sourcerer processes - the {source}...{/source} block must reach the output body so the plugin evaluates it. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) no authentication or user interaction is needed once such a reflection path exists. The practical limiting factor is that a reflection sink for {source} markers must be present in the site's pages; sites where user input is never echoed unsanitized into Sourcerer-processed output, or where the plugin is disabled, are not exploitable.

This is a genuine high-priority issue rather than an inflated high-CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with high vulnerable- and subsequent-system impact across C/I/A) describes remote, unauthenticated, low-complexity exploitation yielding full compromise, consistent with the 'Unauthenticated RCE' classification and CWE-94 root cause. No EPSS score, KEV entry, or public POC is present in the supplied data, so there is currently no confirmation of active or widespread exploitation - the elevated risk here is driven by the exploitability profile and the trivially high impact of code execution, not by observed attacks. The main real-world moderator is exposure: exploitation requires that attacker-controlled input actually be reflected into the rendered HTML of a page processed by Sourcerer, which depends on how a given Joomla site uses the plugin. Signals are consistent (no conflict between CVSS and description); the notable gap is the absence of exploitation-probability data (EPSS) and any proof-of-concept status.

An unauthenticated attacker submits a request whose parameter value contains a crafted {source}<malicious PHP>{/source} payload to a Joomla page that reflects that input into its rendered HTML (for example a search results or error page). When Sourcerer processes the final output it treats the reflected marker as trusted embedded code and executes the attacker's PHP on the server, yielding remote code execution. No public POC is referenced in the available data.