Content Templater Pro Extension For Joomla
Monthly
We are tasked with generating a JSON analysis for CVE-2026-63280. We have the description, CVSS, CWE, EPSS, SSVC, tags, affected products, references. Need to synthesize all. Let's break down the input: - CVE: CVE-2026-63280 - Description: "Conditions administration did not consistently enforce tokens and component/mapped-item permissions." - CVSS: 8.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CWE: CWE-352 (Cross-Site Request Forgery) - EPSS: 0.13% (percentile 3%) - Reported by: Joomla - CPE: multiple from regularlabs.com for extensions (Advanced Module Manager, Conditional Content, Content Templater Pro, Rereplacer Pro) for Joomla. - Tags: CSRF, and the extension names. - SSVC: Exploitation: none, Automatable: no, Technical Impact: total - ENISA EUVD-ID: EUVD-2026-47812 - Affected versions from EUVD: listed for each extension. - References: [cveorg] (None) https://regularlabs.com/ ... maybe missing advisory? Only link to vendor homepage. No specific advisory. So patch status unclear. We need to produce a comprehensive analysis. First, product_name: The vulnerability affects multiple extensions from Regular Labs for Joomla. The primary affected product is a set of extensions, but we need to pick a concise name. Could be "Regular Labs Joomla extensions" or the specific one? Since it's multiple, maybe "Advanced Module Manager" or one of them. Description: "Conditions administration did not consistently enforce tokens and component/mapped-item permissions." That sounds like CSRF and permission issues in the admin interface of these extensions. From tags: CSRF. So likely a CSRF vulnerability in all these extensions. The CWE is CWE-352, consistent. Product name: I'll pick "Regular Labs Joomla Extensions" but that might be 3 words. Alternatively, the primary extension mentioned first in tags: "Advanced Module Manager Extension For Joomla" but that's many words. I'll go with "Regular Labs Extensions" (2 words) or "Regular Labs for Joomla"? The instruction
Authentication bypass in Regular Labs Joomla extensions (Advanced Module Manager, Conditional Content, Content Templater Pro, and ReReplacer Pro) allows remote attackers to circumvent IP and GeoIP-based access restrictions by spoofing forwarded headers, effectively granting unauthorized access to location-restricted content or modules. The vulnerability has a CVSS 7.5 (High) with no authentication or user interaction required, but EPSS predicts a very low likelihood of exploitation (0.19%), and no public exploit code or active exploitation has been identified at this time. Affected versions span multiple extensions, and organizations using GeoIP/IP rules should treat this as a moderate risk requiring prompt attention.
Stored cross-site scripting in Regular Labs Conditional Content and related Joomla extensions enables authenticated administrators to execute
We are tasked with generating a JSON analysis for CVE-2026-63280. We have the description, CVSS, CWE, EPSS, SSVC, tags, affected products, references. Need to synthesize all. Let's break down the input: - CVE: CVE-2026-63280 - Description: "Conditions administration did not consistently enforce tokens and component/mapped-item permissions." - CVSS: 8.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CWE: CWE-352 (Cross-Site Request Forgery) - EPSS: 0.13% (percentile 3%) - Reported by: Joomla - CPE: multiple from regularlabs.com for extensions (Advanced Module Manager, Conditional Content, Content Templater Pro, Rereplacer Pro) for Joomla. - Tags: CSRF, and the extension names. - SSVC: Exploitation: none, Automatable: no, Technical Impact: total - ENISA EUVD-ID: EUVD-2026-47812 - Affected versions from EUVD: listed for each extension. - References: [cveorg] (None) https://regularlabs.com/ ... maybe missing advisory? Only link to vendor homepage. No specific advisory. So patch status unclear. We need to produce a comprehensive analysis. First, product_name: The vulnerability affects multiple extensions from Regular Labs for Joomla. The primary affected product is a set of extensions, but we need to pick a concise name. Could be "Regular Labs Joomla extensions" or the specific one? Since it's multiple, maybe "Advanced Module Manager" or one of them. Description: "Conditions administration did not consistently enforce tokens and component/mapped-item permissions." That sounds like CSRF and permission issues in the admin interface of these extensions. From tags: CSRF. So likely a CSRF vulnerability in all these extensions. The CWE is CWE-352, consistent. Product name: I'll pick "Regular Labs Joomla Extensions" but that might be 3 words. Alternatively, the primary extension mentioned first in tags: "Advanced Module Manager Extension For Joomla" but that's many words. I'll go with "Regular Labs Extensions" (2 words) or "Regular Labs for Joomla"? The instruction
Authentication bypass in Regular Labs Joomla extensions (Advanced Module Manager, Conditional Content, Content Templater Pro, and ReReplacer Pro) allows remote attackers to circumvent IP and GeoIP-based access restrictions by spoofing forwarded headers, effectively granting unauthorized access to location-restricted content or modules. The vulnerability has a CVSS 7.5 (High) with no authentication or user interaction required, but EPSS predicts a very low likelihood of exploitation (0.19%), and no public exploit code or active exploitation has been identified at this time. Affected versions span multiple extensions, and organizations using GeoIP/IP rules should treat this as a moderate risk requiring prompt attention.
Stored cross-site scripting in Regular Labs Conditional Content and related Joomla extensions enables authenticated administrators to execute