The Sourcerer extension for Joomla allows administrators to embed arbitrary PHP, JavaScript, or CSS directly within article content. In the Free edition, the code handling article PHP execution does not require the article creator and last modifier to be Super Users, enabling non‑privileged editors to run PHP. In the Pro edition, the extension does not consistently enforce CSS, JavaScript, or PHP permission settings across tags, attributes, files and article owners, and PHP include attributes can escape the configured include folder. These weaknesses, represented by CWE‑284, can allow an attacker to inject executable code and upload files that bypass detection, leading to code execution or privileged actions.

Joomla sites that have installed the Sourcerer extension from regularlabs.com. Both the Free and Pro editions are affected; version information is not specified in the advisory.

The CVSS score of 9.8 categorises this vulnerability as critical. The EPSS score of less than 1 % indicates a very low likelihood of exploitation in the wild, and the absence from the CISA KEV catalog suggests no publicly known exploits yet. An attacker can exploit the flaw by injecting malicious PHP, JavaScript or CSS through the Joomla administrative interface, because the extension bypasses the configured permission checks. If successful, the attacker could execute code in the context of the site, potentially gaining full control.