CVE-2026-74253 is a critical vulnerability in the regularlabs.com Sourcerer extension for Joomla, versions 1.0.0 through 13.1.1. The flaw arises from improper control of code generation (CWE-94) due to the extension processing {source} blocks found in Joomla's final rendered HTML without reliably determining the source of that code. This allows unauthenticated attackers to execute arbitrary code remotely. The vulnerability has a CVSS 4.0 base score of 10.0, indicating maximum severity, with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

An unauthenticated attacker can exploit this vulnerability to execute arbitrary code remotely on affected Joomla installations using the Sourcerer extension before version 14.0.0. This can lead to full system compromise, including unauthorized access, data modification, and service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling the Sourcerer extension or restricting access to trusted users only to mitigate risk.