Quick answers
- Is CVE-2026-85192 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-85192 being exploited in the wild.
- How severe is CVE-2026-85192?
- Informational severity, with a CVSS score of 7.2, published 14 September 2026.
- Which products and versions are affected?
- Regular Labs Conditional Content < 8.0.0.
- Is there a fix for CVE-2026-85192?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-85192 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-85192?
- Check whether you run Regular Labs Conditional Content at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a PHP code injection in the Conditional Content Pro extension for Joomla. The extension accepts inline PHP condition rules in article syntax without proper validation of the code author. The vulnerable component fails to verify that only trusted authors can inject PHP; Joomla's text filter preserves the PHP syntax, allowing arbitrary code execution when the article is published. The attack requires authentication and publishing privileges but runs with web-server process permissions. An attacker with author or publisher role can achieve remote code execution by crafting malicious PHP conditions in article content.
Affected products
- Regular Labs Conditional Content < 8.0.0
Timeline
- 2026-09-14: disclosed