The Cache Cleaner extension for Joomla by regularlabs.com suffers from inconsistent enforcement of CSRF token validation and privilege checks in its administrator URL purge functionality. This inconsistency means that some cache management operations can be triggered without a valid CSRF token and without verifying the user's cache-management permissions. This flaw could allow an attacker with some level of privileges (low) to perform unauthorized cache purging actions. The vulnerability is tracked as CVE-2026-64871 and affects versions 1.0.0 through 9.7.6 of the extension. No official patch or remediation guidance has been published at this time.

An attacker with limited privileges could exploit this vulnerability to perform unauthorized cache purging actions via CSRF attacks. This could lead to unintended cache clearing, potentially disrupting website performance or availability. The confidentiality, integrity, and availability impacts are limited to low and none respectively, as per the CVSS vector. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider restricting access to the Cache Cleaner extension's administrative functions and monitor for unusual cache purge activities. Applying strict access controls and ensuring users have minimal necessary privileges may reduce risk.