Sourcerer for Joomla: unauthenticated RCE exploited in the wild since before a working fix existed — the vendor's first two patches did not close it, and the CVE was re-scoped in place to widen the affected range

Sourcerer for Joomla: unauthenticated RCE exploited in the wild since before a working fix existed — the vendor's first two patches did not close it, and the CVE was re-scoped in place to widen the affected range

CVE-2026-74253 (Regular Labs' Sourcerer, the Joomla extension that renders PHP, JS and CSS embedded in content) is CWE-94 (Improper Control of Generation of Code), CVSS 4.0 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H — every metric at its worst), credited to finder Lukasz Rybak. Before Sourcerer 14.0.0, only article-text content had its origin verified before Sourcerer would execute embedded code; code reaching the page through a module, component, page head, or any other rendering position ran unconditionally. 14.0.0 (17 Aug) added trust-marking for article content and unmodified custom-module output, but did not close every route by which untrusted content could reach the render — URL and form parameters, raw request bodies, uploads, cookies and headers all remained live — and the CVE record originally scoped the fix as "<14.0.0", affected 1.0.0–13.1.1.

The flaw has been under active exploitation since roughly 2026-08-19 per the Joomla Security Strike Team: "Exploited Yes, in the wild since roughly 19 August 2026 per the Joomla Security Strike Team, confirmed to us 24 August 2026" (mySites.guru, citing the Joomla Security Strike Team, 2026-08-26) — two days after the first "fix" shipped and seven days before a working one existed. Sourcerer 15.0.0, also never tagged a security release, also failed to close it. Only 16.0.0 (26 Aug) closes the untrusted-input-delivery routes and additionally blocks common filesystem-write PHP functions by default. On 2026-08-26 the Joomla CNA re-scoped CVE-2026-74253 in place, widening the affected range from 1.0.0–13.1.1 to 1.0.0–15.0.0: "the Joomla CNA widened CVE-2026-74253 from 'Sourcerer < 14.0.0' to 'Sourcerer < 16.0.0', moving the affected range from 1.0.0-13.1.1 to 1.0.0-15.0.0, after the vendor's first two attempts at a fix turned out not to close the flaw" (mySites.guru, 2026-08-26) — meaning every site that updated to 14.0.0, 14.0.1 or 15.0.0 in good faith, told by both its extension manager and the CVE record itself that it was patched, was exploitable the entire time.

HTML-escaping input is explicitly not a mitigation here, and the reason is design rather than oversight: "code written in a WYSIWYG editor arrives with its angle brackets converted to HTML entities. So that code still runs, Sourcerer decodes entities inside its own tags before handling the contents" (mySites.guru, 2026-08-26) — the decoding cannot distinguish administrator-typed code from attacker-supplied text. PHP execution is enabled by default; the default forbidden-function list blocks shell-exec functions but not file-write functions. A separate, earlier CVE, CVE-2026-64796 (fixed in 13.0.0, affected 1.0.0–12.2.8), closed only the article-content path and does not protect against this one.

Triage: any site that "patched" Sourcerer to 14.x or 15.0.0 between 17 and 26 August must be re-verified against 16.0.0 and treated as having been exposed the entire window regardless of what its extension manager reported. Look for PHP execution originating from content-rendering code paths outside article bodies — module output, page-head injection, or request-parameter-derived content reaching Sourcerer's render function — since that is exactly the delivery route the 14.0.0/15.0.0 fixes failed to close. A web-server process spawning a shell or writing new PHP files to disk from within Joomla's content-rendering pipeline has no legitimate explanation.