The Modules Anywhere Pro extension for Joomla allows content authors to create module tags that override any module parameter without verifying the tag’s author. Attackers can craft tags that replace parameters used by Joomla modules such as the Feed module. When the Feed module processes an overridden rssurl parameter, the server will request the supplied URL, which may be a local file: URL or an external address. This behavior exposes the site to Local File Inclusion and Server Side Request Forgery, giving an attacker the ability to read files on the server or examine internal network addresses.

The vulnerability is present in regularlabs.com’s Modules Anywhere (Pro) extension for Joomla versions 1.5.0 through 9.0.5. Any Joomla installation that includes this extension and the Feed module is potentially affected, regardless of the specific Joomla core version.

The CVSS score of 8.5 indicates high severity. The EPSS score is unavailable, so the exact likelihood of exploitation is unclear, but the flaw is active in a widely deployed CMS extension, making it a realistic target for attackers. The vulnerability is not listed in the CISA KEV catalog; however, because the override feature is enabled by default and no authentication check is performed, a remote attacker can inject a malicious module tag via publicly accessible content or by manipulating requests to Joomla pages to cause the Feed module to fetch arbitrary local or network URLs.