CISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code Execution
Summary: CISA added CVE-2026-48907, a CVSS 10.0 improper access control flaw in Widget Factory's Joomla Content Editor, to its Known Exploited Vulnerabilities catalog on Tuesday, citing active exploitation. The bug affects JCE versions 1.0.0 through 2.9.99.4, lets unauthenticated users create editor profiles and upload and execute PHP code, and was patched in version 2.9.99.5 on June 3, 2026.
What you should know: Joomla's own warning is that working exploit code is public and the attacks are automated, so a site with no public registration is not safe - and updating closes the entry point but does not clean a site already compromised, leaving any dropped web shell in place.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2026-48907
- Related
- CVE-2026-48907: Widget Factory Joomla Content Editor Improper Access Control Vulnerability Known Exploited Vulnerabilities · Jun 16, 2026⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More Cyber Risks ·New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026