The vulnerability allows an unauthenticated attacker to inject and execute arbitrary PHP code through unverified reflected input in the {source} blocks that disjointly processed by the older versions of the Sourcerer extension. The flaw is a classic code injection weakness (CWE-94), which can compromise confidentiality, integrity, and availability of the affected Joomla site. The impact is potentially complete system takeover if an attacker crafts a malicious request that includes executable code within the reflected input.

Regular Labs Sourcerer extension for Joomla users running any version prior to 14.0.0 are affected. Escalation details are not provided beyond the preceding major release threshold.

The CVSS base score of 10 indicates extremely high severity and the vulnerability is exploitable without authentication. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through a crafted request that reflects user input directly into the rendered HTML; because the code is executed server-side, attackers can achieve remote code execution by providing malicious {source} blocks. The absence of an authentication requirement means any user can initiate the exploit, making it a critical exposure for sites with the vulnerability.