Is CVE-2026-63684 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63684 being exploited in the wild.

How severe is CVE-2026-63684?

Informational severity, published 22 July 2026.

Which products and versions are affected?

Regular Labs Content Templater 1.0.0-13.0.0; Regular Labs ReReplacer 1.0.0-15.0.3; Regular Labs Snippets 1.0.0-9.3.10.

Is there a fix for CVE-2026-63684?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-63684 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-63684?

Check whether you run Regular Labs Content Templater, Regular Labs ReReplacer or Regular Labs Snippets at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63684: Regular Labs Joomla extensions improper access control and CSRF

CVE-2026-63684 · Severity: info · Published 2026-07-22

Multiple Regular Labs extensions for the Joomla content management system contain security flaws that could allow unauthorized users to modify website content or settings. These extensions are used to manage templates, search-and-replace functions, and content snippets. An attacker could potentially exploit these weaknesses to change site configurations or gain access to sensitive administrative data.

Technologies: Regular Labs ReReplacer. Vendors: Regular Labs.

Quick answers

Is CVE-2026-63684 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63684 being exploited in the wild.
How severe is CVE-2026-63684?: Informational severity, published 22 July 2026.
Which products and versions are affected?: Regular Labs Content Templater 1.0.0-13.0.0; Regular Labs ReReplacer 1.0.0-15.0.3; Regular Labs Snippets 1.0.0-9.3.10.
Is there a fix for CVE-2026-63684?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-63684 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-63684?: Check whether you run Regular Labs Content Templater, Regular Labs ReReplacer or Regular Labs Snippets at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Content Templater, ReReplacer, and Snippets extensions for Joomla fail to consistently implement CSRF tokens, item-level permission checks, and input validation across administrator actions, editor popups, and import/export requests. This vulnerability (CWE-284 and CWE-352) allows unauthorized backend users or remote attackers (via Cross-Site Request Forgery) to expose, create, or modify extension configurations and items. The issue stems from inconsistent enforcement of security controls in the backend components of these extensions. Users should update to versions beyond the affected ranges specified by the vendor.

Affected products

Regular Labs Content Templater extension for Joomla 1.0.0-13.0.0
Regular Labs ReReplacer extension for Joomla 1.0.0-15.0.3
Regular Labs Snippets extension for Joomla 1.0.0-9.3.10

Timeline

2026-07-22: disclosed
2026-07-22: advisory

References

https://regularlabs.com/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.