The Cache Cleaner extension for Joomla implements administrator URLs that purge site cache, yet these URLs do not consistently enforce CSRF token validation or verify that the caller has cache‑management rights. An attacker who can craft or submit a request to one of these purge endpoints can delete or force rebuild cached content without having the necessary privileges. This flaw corresponds to inadequate access control (CWE‑284) and cross‑site request forgery (CWE‑352), which together enable the attacker to change site state or create denial‑of‑service conditions by exhausting server resources or presenting stale data.

The vulnerability affects sites that use the regularlabs.com Cache Cleaner extension for Joomla. No specific version range is listed; therefore, any installation that relies on the legacy token handling logic in this extension is potentially impacted.

The CVSS score of 5.4 denotes moderate severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation at present. The issue is not included in CISA’s KEV catalog. The likely attack vector is remote, involving any user who can send HTTP requests to the admin cache‑purge URLs. Because the extension fails to validate CSRF tokens and check user permissions, attackers who can craft or send requests to the cache‑purge URLs may trigger purges without possessing a valid CSRF token or cache‑management privileges. No additional environmental prerequisites are specified, so any Joomla site running the affected extension requires remediation.