Security
Regular Labs fixes Joomla extension vulnerabilities
Regular Labs has fixed two vulnerabilities in its Joomla extensions, including a high-severity code-execution issue requiring coordinated updates to Articles Anywhere and Sourcerer.
Research published by mySites.guru covers CVE-2026-102802, a trust-handling flaw affecting Articles Anywhere versions 19.0.0 through 20.1.0 when used with Sourcerer. PHP placed in an included article could run with the permissions of the trusted article containing it. The issue is rated High with a provisional CVSS 4.0 score of 7.7. It is fixed in Articles Anywhere 20.1.1 and Sourcerer 17.0.1; both updates are required.
The same report details CVE-2026-102801 in Users Anywhere. Before 3.0.1, content authors could use tags to display usernames and email addresses despite administrator settings disabling that output. mySites.guru classifies this as Medium, with a provisional score of 5.3.
Both vulnerabilities affect the extensions rather than Joomla core and are present in Free and Pro editions. The CVE records remain reserved, and mySites.guru reports no known exploitation in the wild. Administrators should update Articles Anywhere and Sourcerer together wherever both are installed, and update Users Anywhere to 3.0.1.
Originally reported by mySites.guru.