In June 2026, an extremely serious vulnerability with a CVSS score of 10.0 was identified in the JCE (Joomla Content Editor) extension, which is one of the most popular WYSIWYG editors for the Joomla content management system. The flaw is present in the JCE product developed by the Widget Factory team and allows unauthenticated attackers to upload and execute arbitrary PHP code on affected Joomla sites.

On 16 June 2026, the CISA (Cybersecurity and Infrastructure Security Agency) added the vulnerability to its catalogue of Known Exploited Vulnerabilities (KEV), confirming that the flaw is actively being exploited in the real world.

Technical details

The vulnerability falls under the CWE-284: Improper Access Control category. JCE allows administrators to create multiple editor profiles, each with its own finely tuned permissions — for example, which user groups can upload files, browse the media library or manage content.

The root of the problem is that the file upload mechanism does not adequately verify whether the user sending the request is actually authenticated and authorised in accordance with the rules of the given profile, if the profile is loaded without an authenticated session. As a result, an attacker — without any authentication credentials — can create a new editor profile and then, by exploiting this, upload a PHP webshell to a web-accessible directory and execute it.

This process effectively enables full remote code execution (RCE) without any authentication or user interaction.

Why is it so dangerous?

Experts classify this vulnerability as high-risk for several reasons:

• No authentication is required – the attack can be launched by anyone with network access to the affected Joomla site.
• A direct path to code execution – a successful exploit results immediately in remote code execution, without chaining further vulnerabilities.
• Suitable for mass exploitation – the presence of Joomla sites and JCE can be easily identified by automated scanners based on predictable paths and HTTP response patterns.
• Wide attack surface – JCE runs on a significant proportion of the Joomla ecosystem, meaning that potentially hundreds of thousands of websites are affected.

Timeline

Date	Event
26 May 2026	The CVE identifier is reserved
3 June 2026	The patched version, JCE 2.9.99.5, is released
5 June 2026	The vulnerability has been disclosed (CVE-2026-48907)
16 June 2026	CISA adds the flaw to the KEV catalogue, confirming active exploitation
19 June 2026	Deadline for federal (US) organisations to install the patch

The affected versions range from JCE 1.0.0 to 2.9.99.4.

Active exploitation in the wild

According to security researcher Phil E. Taylor (mySites.guru), attackers are exploiting the vulnerability to import a fake, malicious editor profile, and then use this to install a webshell, which provides persistent backdoor access to the compromised server.

Recommended measures

If a Joomla-based website uses the JCE extension, we recommend carrying out the following steps immediately:

1. Update immediately – update JCE to version 2.9.99.5 or later, regardless of the Joomla core version.
2. Checking for compromise – examining the web server logs for POST requests directed at JCE upload paths (e.g. /index.php?option=com_jce&task=...), and scanning media directories for suspicious, recently modified PHP files.
3. Auditing editor profiles – reviewing upload permissions for all JCE profiles, and disabling executable file types (.php, .pht, .phtml, .shtml, .php5, .php7, .phar, .inc, etc.) even for authenticated users.
4. Restricting upload destination directories – where possible, uploads should be directed to directories outside the webroot.

.htaccess protection until the update is applied

The following rewrite rule, which can be added to the .htaccess file, blocks access to the vulnerable module:

<IfModule mod_rewrite.c>
    RewriteEngine On
    # --------------------------------------------------------------------
    # 1) Block unauthenticated / suspicious requests to JCE component
    #    endpoints that are used to create editor profiles or upload files.
    #    The exploit chain abuses com_jce upload/profile task requests.
    # --------------------------------------------------------------------
    RewriteCond %{QUERY_STRING} option=com_jce [NC]
    RewriteCond %{QUERY_STRING} task=upload|task=plugin|task=profile [NC]
    RewriteCond %{HTTP_COOKIE} !joomla_user_state=logged_in [NC]
    RewriteRule ^ - [F,L]
 
    # Belt-and-braces: block direct POSTs to common JCE ajax/upload endpoints
    RewriteCond %{REQUEST_METHOD} POST
    RewriteCond %{REQUEST_URI} /(components|plugins)/(com_jce|editors-xtd_jce|jce)/.*(upload|profiles?)\.php [NC]
    RewriteRule ^ - [F,L]
</IfModule>

Summary

CVE-2026-48907 is a textbook example of how a feature that is useful in itself — flexible, customisable access control — can become a critical security risk if the implementation of access control is flawed. Given the maximum severity score and the confirmed, active exploitation, all Joomla operators using the JCE extension must update their systems immediately and also carry out a post-compromise audit.

• cybersecurity
• website security
• php
• news