JCE Editor Extension for Joomla Vulnerability Allows Unauthenticated Profile Creation
CVE-2026-48907

10CRITICAL

Key Information:

Vendor

Joomlacontenteditor.net

Status
Joomla Content Editor (jce) Extension For Joomla
Vendor
CVE Published:
5 June 2026

Badges

📈 Trended📈 Score: 1,540👾 Exploit Exists🟡 Public PoC🟣 EPSS 80%🦅 CISA Reported📰 News Worthy

What is CVE-2026-48907?

CVE-2026-48907 is a significant vulnerability found in the JCE (Joomla Content Editor) extension for the Joomla content management system. This vulnerability allows unauthenticated users to create new editor profiles within the system. This capability can lead to a chain of security issues, as it enables unauthorized users to upload and execute PHP code on the server. Because Joomla is widely used for building websites and managing content, the exploitation of this vulnerability could severely undermine the security of organizations relying on this platform. If an attacker successfully exploits this flaw, they can gain control of the website, potentially leading to unauthorized data access, defacement, or further exploitation of connected systems.

Potential impact of CVE-2026-48907

  1. Unauthorized Code Execution: The ability for unauthenticated users to upload and execute PHP code on affected systems introduces a severe security risk. Attackers can potentially deploy malicious scripts, affecting not just the immediate installation but possibly the wider network or connected services.

  2. Data Breach and Compromise: With unauthorized access to backend capabilities, attackers could exfiltrate sensitive data stored within the system or manipulate existing data, highlighting significant risks to user data and organizational confidentiality.

  3. Wide Range of Exploits: The nature of this vulnerability opens the door for various attack vectors, including remote code execution, which can lead to the deployment of ransomware or other malicious software, potentially impacting an entire organization's operations and financial standing.

CISA has reported CVE-2026-48907

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-48907 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected Version(s)

Joomla Content Editor (JCE) extension for Joomla 1.0.0-2.9.99.4

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-48907
Created by ywh-jfellus

CVE-2026-48907
Created by wearehackers160

CVE-2026-48907
Created by HORKimhab

News Articles

favicon imageIt Security News

CVE-2026-48907: How the Joomla JCE Exploit Works and What to Do About It - IT Security News

CVE-2026-48907 in the Joomla JCE plugin lets unauthenticated attackers drop PHP web shells with a single crafted request. Here is how the attack works and how to check if your site was hit. CVE-2026-48907: How the Joomla JCE Exploit Works…Read more →

1 week ago

favicon imageLatesthackingnews

Joomla JCE Exploit: Attack Path and Detection Guide

CVE-2026-48907 turns JCE's profile import into an unauthenticated RCE. Here is how the Joomla JCE exploit works and how to detect a compromised site.

1 week ago

favicon imageBleepingComputer

CISA orders feds to patch max severity Joomla plugin flaw by Friday

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch a maximum-severity flaw in the Widget Factory Joomla Content Editor (JCE) plugin that is being actively exploited in the wild.

1 week ago

References

https://www.joomlacontenteditor.net/
product

EPSS Score

80% chance of being exploited in the next 30 days.

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 📈

    Vulnerability started trending

  • 📰

    First article discovered by The Hacker News

  • 🦅

    CISA Reported

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

David Jardin
Uwe Flottemesch
.