CVE-2026-64874 is a CWE-200 vulnerability in the Cache Cleaner Pro extension for Joomla by regularlabs.com. It causes CDN credentials to be exposed in administrator request URLs, allowing unauthorized actors to access sensitive information. The vulnerability affects versions 1.0.0 through 9.7.6. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No patch or official remediation has been disclosed as of the publication date.

The exposure of CDN credentials in administrator request URLs can lead to unauthorized access to CDN resources, potentially allowing attackers to manipulate, disrupt, or exfiltrate data served via the CDN. This compromises confidentiality, integrity, and availability of the affected systems and data. Given the critical CVSS score, exploitation could have severe consequences for affected Joomla sites using this extension.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid exposing administrator request URLs publicly and consider restricting access to the Joomla administration interface. Monitor for updates from regularlabs.com regarding patches or mitigations.