Executive brief
Multiple Regular Labs extensions for the Joomla content management system contain a security flaw in how they handle administrative requests. These extensions are used to manage website modules, content, and caching. An attacker could trick a logged-in administrator into performing unintended actions or allow lower-privileged users to access restricted data and modify site configurations.
Technical details
A vulnerability involving Improper Access Control (CWE-284) and Cross-Site Request Forgery (CWE-352) exists in several Regular Labs Joomla extensions. Privileged AJAX endpoints fail to consistently require valid CSRF tokens or verify that the requesting user has the appropriate component/item permissions. An attacker can exploit this by either performing a CSRF attack against an authenticated administrator or by using a low-privileged account to invoke sensitive lookups and mutations. Affected extensions include Advanced Module Manager, Articles Anywhere, Cache Cleaner, and several others within the specified version ranges.
Affected products
- Regular Labs Advanced Module Manager extension for Joomla 1.0.0-11.0.1
- Regular Labs Articles Anywhere extension for Joomla 1.0.0-18.0.2
- Regular Labs Articles Field extension for Joomla 1.0.0-4.7.1
- Regular Labs Better Frontend Link extension for Joomla 1.0.0-2.2.5
- Regular Labs Cache Cleaner extension for Joomla 1.0.0-9.7.6
- Regular Labs CDN for Joomla extension for Joomla 1.0.0-7.3.7
- Regular Labs Conditional Content extension for Joomla 1.0.0-6.0.0
- Regular Labs Content Templater extension for Joomla 1.0.0-13.0.0
- Regular Labs DB Replacer extension for Joomla 1.0.0-8.2.7
- Regular Labs Email Protector extension for Joomla 1.0.0-6.3.7
- Regular Labs Regular Labs Extension Manager extension for Joomla 1.0.0-9.2.5
- Regular Labs GeoIP extension for Joomla 1.0.0-6.3.8
Timeline
- 2026-07-22: disclosed: Vulnerability published by Joomla! Project and NVD