Security
Sourcerer 14.0.0 fixes critical Joomla code execution flaw
Regular Labs has released Sourcerer 14.0.0 to address a critical Joomla vulnerability that could execute PHP from unverified or reflected content.
The affected extension is Sourcerer, available in Free and Pro editions from Regular Labs. CVE-2026-74253 affects versions 1.0.0 through 13.1.1 and is fixed in 14.0.0, released on 17 August 2026.
The issue is classified as improper control of code generation (CWE-94), with code injection also identified under CAPEC-242. The Joomla CNA rates it CVSS 4.0 at 10.0 Critical, describing unauthenticated remote code execution. mySites.guru published the research and does not report exploitation in the wild; it also says it will not publish a working payload.
Administrators should update to 14.0.0 and test the deliberate breaking change, since previously accepted code from unverified page locations may stop running. If an immediate update is impossible, disabling the Sourcerer system plugin removes the exposure but also disables the extension. The separate earlier issue, CVE-2026-64796, affected versions through 12.2.8 and was fixed in 13.0.0.
Originally reported by mySites.guru.