This vulnerability involves improper access control (CWE-284) in the Sourcerer extension for Joomla. The free version allowed execution of PHP code in articles without requiring both the article creator and last modifier to have Super User privileges. The pro version did not consistently enforce configured permissions for CSS, JavaScript, and PHP, allowing potential unauthorized execution or inclusion of code. PHP include attributes could escape the intended include folder restrictions, and executable script or style variants could bypass detection, increasing the risk of unauthorized code execution within Joomla articles.

The vulnerability allows unauthorized users to execute PHP code within Joomla articles due to insufficient access control checks. This could lead to unauthorized code execution, potentially compromising the Joomla site. The inconsistent enforcement of permissions and the ability to escape include folder restrictions increase the risk of exploitation. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or remediation level has been published. Users should monitor regularlabs.com and Joomla advisories for updates and apply any official patches once available. Until then, restrict access to article creation and modification to trusted Super Users only and consider disabling the Sourcerer extension if possible.