Critical severity · published Jun 5, 2026
CVE-2026-48907
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
In wildKEV
9.8
CVSS
85.4%
EPSS
Yes
On KEV
Description
A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)85.4% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Jun 16, 2026
Federal remediation dueJun 19, 2026
Ransomware campaign useNot known
Affected products
Which versions
JC
Joomla Content Editor (JCE) extension for Joomla · joomlacontenteditor.net
1.0.0-2.9.99.4 · source: vendor
JC
Jce · Widgetfactorylimited
before 2.9.99.5 · source: NVD
JC
Joomla Content Editor · Widget Factory
All versions, or not specified · source: KEV
In the news
VulnerabilityCritical
U.S. CISA adds Widget Factory Joomla Content Editor flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Widget Factory Joomla Content Editor (JCE) flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Widget Factory Joomla Content Editor (JCE) flaw, tracked as CVE-2026-48907 (CVSS score of 10.0), to its Known Exploited Vulnerabilities (KEV) catalog. “A vulnerability in the JCE […]
Jun 17, 2026·Security Affairs
VulnerabilityCritical
CISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code Execution
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a maximum-severity security flaw impacting Widget Factory Joomla Content Editor (JCE) to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
The vulnerability, tracked as CVE-2026-48907 (CVSS score: 10.0), is a case of improper access control that could facilitate arbitrary
Jun 17, 2026·The Hacker News
VulnerabilityHigh
[CISA KEV] CVE-2026-48907: Widget Factory Joomla Content Editor - Widget Factory Joomla Content Editor Improper Access Control Vulnerability
Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users.
JCJoomla Content Editor CVE-2026-48907
Jun 16, 2026·CISA KEV
Affected product
JC
Joomla Content Editor (JCE) extension for Joomla
joomlacontenteditor.net
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-48907
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-48907
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
product
https://www.joomlacontenteditor.net/
More from Joomla Content Editor (JCE) extension for Joomla
6.5
CVE-2026-65891
Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor (JCE) < 2.9.99.10