Conditional Content Pro CVE-2026-85192

Requires the Conditional Content Pro extension (not the free edition) installed on a Joomla site running a version below 8.0.0, and an authenticated account with sufficient privilege to author and publish articles (CVSS PR:H). The attacker must be able to insert an inline PHP Condition Rule into article content and cause it to be published; execution then occurs automatically as the web-server process with no additional user interaction (UI:N). Limiting factors: exploitation is impossible for anonymous/unauthenticated visitors, depends on the Pro edition and its inline-PHP-rule feature being present, and is contained to environments where authoring rights are granted to potentially untrusted users or where a privileged account is compromised.

The CVSS 4.0 base score of 9.4 is high but the vector (AV:N/AC:L/PR:H/UI:N) is the key nuance: exploitation is network-reachable and low-complexity, yet requires PR:H - a privileged, authenticated Joomla account able to author/publish articles containing Condition Rules. That materially narrows the attacker population to trusted content contributors, administrators, or anyone who has compromised such an account, moving this from 'internet-wide worm' territory toward insider/compromised-credential and privilege-boundary abuse. No EPSS score, KEV listing, or public PoC was provided, so there is no evidence of active exploitation or automated weaponization at this time; the risk is real but conditional. Given that a single privileged account yields full code execution as the web-server user, even a mid-sized municipal IT team in gniezno should treat this as urgent patch-priority wherever multiple or semi-trusted editors share a Joomla install. Net assessment: genuinely dangerous where the privilege prerequisite is met, but not a mass-exploitation candidate absent broader author access.

A Joomla user with author/publish privileges (or an attacker who has phished or otherwise taken over such an account) creates an article containing a PHP Condition Rule with a malicious payload. On publish, the Conditions evaluator executes the PHP as the web-server process, giving the attacker a foothold - for example a webshell, credential theft from configuration.php, or lateral movement - without any additional victim interaction.