CVE-2026-48907: critical vulnerability in Joomla's JCE Editor extension, added to CISA's KEV catalog

CVE-2026-48907: critical vulnerability in Joomla's JCE Editor extension, added to CISA's KEV catalog

In short

A critical vulnerability (CVE-2026-48907, CVSS 10.0) has been published in the JCE Editor extension for Joomla, made by Widget Factory Limited [1]. The flaw allows unauthenticated users to create new editor profiles and, from there, upload and execute PHP code on the server [1]. The CVE also appears in CISA's KEV catalog of vulnerabilities with confirmed active exploitation [2]. If your website runs on Joomla and uses this extension, today's recommendation is clear: check whether you have the affected version installed, update it, and review whether there are any editor profiles you didn't create yourself.

What it is and why it matters

JCE Editor is an extension for Joomla that extends the content editor's functionality. According to the official vulnerability description, an access control flaw allows unauthenticated users to create new editor profiles; with that foothold, an attacker can go on to upload and execute PHP code on the server hosting the site [1]. In other words, there's no need for an account or valid credentials to attempt the attack, since the vulnerability's own description places it at the profile-creation step performed by "unauthenticated users" [1].

The combination of maximum severity (CVSS 10.0, "critical" severity according to NVD) [1] and confirmed presence in CISA's KEV catalog [2] is what prompts this alert: KEV lists vulnerabilities with documented active exploitation, not merely theoretical flaws [2]. Our intelligence radar at OCIRIA likewise classifies it as critical and within the remote code execution category, consistent with this information.

Who is affected

It affects websites built on Joomla that have the JCE Editor extension from Widget Factory Limited installed [1]. We do not have verified data on how many sites currently have it active, so we cannot quantify the actual scope; what is confirmed is that wherever this extension is present and not updated, the risk applies regardless of the organization's size or sector, because the flaw does not require prior authentication [1].

How to know if you're vulnerable

First, check whether your Joomla site has the JCE Editor extension installed and which version it's running; the Joomla admin panel itself lets you view the list of installed extensions and their versions. It's also worth reviewing the JCE editor profiles section for any profiles you don't recognize or that no one on your team created, since that is precisely the vector described in this vulnerability [1]. Beyond this internal review, it also makes sense to check what part of your website and infrastructure is visible from the outside, since a broader-than-necessary exposed surface makes this kind of unauthenticated attack easier.

How to protect yourself

• Update the JCE Editor extension to the version the vendor has released to fix this flaw; until you do, the risk remains as described in the official record [1].
• Review and remove any JCE editor profile that you did not create or authorize yourself; this is the direct recommendation our internal analysis gives for this type of flaw.
• If you detect suspicious profiles or PHP files you don't recognize on the server, treat the site as potentially compromised and review access logs and recent changes before considering the incident closed.
• Restrict access to the Joomla admin panel (by IP, VPN, or additional authentication) as an extra layer, although this does not replace updating the extension.
• Keep an up-to-date inventory of the extensions installed on your Joomla sites so you can react quickly to future similar alerts.

Frequently asked questions

Do I need an administrator account for this vulnerability to affect me?

No. The official description itself states that the problem allows unauthenticated users to create new editor profiles, so no prior credentials are required to attempt exploitation [1].

Is this vulnerability being exploited in practice?

Yes, it appears in CISA's KEV catalog, which specifically lists vulnerabilities with confirmed active exploitation [2].

Is it enough to remove the suspicious editor profiles without updating the extension?

Removing unauthorized profiles is a useful step, but as long as the extension is not updated, the access control flaw remains present and could be exploited again [1]. Doing both is recommended.

Does this affect Joomla in general or only this extension?

Based on the available information, the flaw resides in the JCE Editor extension from Widget Factory Limited, not in Joomla's core [1].

Sources

• [1] https://nvd.nist.gov/vuln/detail/CVE-2026-48907
• [2] https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json