CVE-2026-85192: CWE-94 Improper Control of Generation of Code ('Code Injection') in regularlabs.com Conditional Content Pro extension for Joomla
CVE-2026-85192 is a critical vulnerability in the Conditional Content Pro extension for Joomla versions 1.0.0 through 7.1.0. The flaw allows authenticated users with privileges to execute arbitrary PHP code remotely by embedding inline PHP Condition Rules in article syntax. The extension does not verify the author of the article before evaluating the PHP code, and Joomla's author text filter preserves this syntax, resulting in code execution with the web server's privileges.
AI Analysis
Technical Summary
The Conditional Content Pro extension for Joomla prior to version 8.0.0 accepts inline PHP Condition Rules within article content. This PHP code is passed to the Conditions evaluator without verifying the article's author, enabling authenticated privileged users to execute arbitrary PHP code remotely. Joomla's author text filter does not block this syntax, allowing the code to run as the web server process, constituting a remote code execution vulnerability classified under CWE-94.
Potential Impact
An authenticated user with sufficient privileges can execute arbitrary PHP code on the web server hosting the Joomla site. This can lead to full compromise of the web server, data theft, service disruption, or further attacks within the network. The vulnerability is critical with a CVSS 4.0 score of 9.4, indicating high exploitability and impact.
Mitigation Recommendations
No official patch or fix is currently documented. Users should upgrade to Conditional Content Pro version 8.0.0 or later once available, as the vulnerability affects versions up to 7.1.0. Until a fix is released, restrict article editing privileges to fully trusted users only and avoid publishing articles containing inline PHP Condition Rules. Monitor vendor advisories for official remediation updates.
CVE-2026-85192: CWE-94 Improper Control of Generation of Code ('Code Injection') in regularlabs.com Conditional Content Pro extension for Joomla
Description
CVE-2026-85192 is a critical vulnerability in the Conditional Content Pro extension for Joomla versions 1.0.0 through 7.1.0. The flaw allows authenticated users with privileges to execute arbitrary PHP code remotely by embedding inline PHP Condition Rules in article syntax. The extension does not verify the author of the article before evaluating the PHP code, and Joomla's author text filter preserves this syntax, resulting in code execution with the web server's privileges.
CVSS v4.0
Score 9.4critical
Affected software
regularlabs.com
Conditional Content Pro extension for Joomla
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Conditional Content Pro extension for Joomla prior to version 8.0.0 accepts inline PHP Condition Rules within article content. This PHP code is passed to the Conditions evaluator without verifying the article's author, enabling authenticated privileged users to execute arbitrary PHP code remotely. Joomla's author text filter does not block this syntax, allowing the code to run as the web server process, constituting a remote code execution vulnerability classified under CWE-94.
Potential Impact
An authenticated user with sufficient privileges can execute arbitrary PHP code on the web server hosting the Joomla site. This can lead to full compromise of the web server, data theft, service disruption, or further attacks within the network. The vulnerability is critical with a CVSS 4.0 score of 9.4, indicating high exploitability and impact.
Mitigation Recommendations
No official patch or fix is currently documented. Users should upgrade to Conditional Content Pro version 8.0.0 or later once available, as the vulnerability affects versions up to 7.1.0. Until a fix is released, restrict article editing privileges to fully trusted users only and avoid publishing articles containing inline PHP Condition Rules. Monitor vendor advisories for official remediation updates.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Joomla
- Date Reserved
- 2026-09-03T12:01:51.929Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aa79c0455bf5e2cf5ac9da1
Added to database: 09/14/2026, 07:02:28 UTC
Last enriched: 09/14/2026, 07:16:43 UTC
Last updated: 09/14/2026, 09:53:45 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.