Widget Factory Joomla Content Editor Improper Access Control Vulnerability (CVE-2026-48907)

What is affected, what to do

A critical improper access control vulnerability in JCE (Joomla Content Editor) by Widget Factory Limited allows unauthenticated remote attackers to fully compromise affected systems, impacting confidentiality, integrity, and availability. The flaw is actively exploited in the wild and has been added to the CISA Known Exploited Vulnerabilities catalog, signaling confirmed weaponization. The attack requires no privileges and no user interaction, making mass exploitation straightforward. Organizations running Joomla installations with the JCE editor plugin must immediately verify exposure and apply available patches. Given the combination of active exploitation, network-accessible attack surface, and maximum severity ratings, this vulnerability demands the highest remediation priority.

The vulnerability is being actively exploited; treat it as a priority. Update jce to version 2.9.99.5, Joomla Content Editor to version 2.9.99.5. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Joomlacontenteditor.net Joomla Content Editor (JCE) extension for Joomla eq 1.0.0-2.9.99.4..1.0.0-2.9.99.4

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Upgrade the JCE extension to version 2.9.99.5 or later immediately (Joomla Administrator → Extensions → Manage → Update). The vendor patch from widgetfactorylimited covers all versions in the 1.0.0-2.9.99.4 range.
   • Until patched: block the com_jce component at the reverse proxy or WAF for unauthenticated requests, specifically /index.php?option=com_jce* and any direct calls to /components/com_jce/editor/ and /plugins/editors/jce/.
   • Audit Joomla upload directories (/images/, /media/, /tmp/) for newly created .php, .phtml, .phar, .php7, .pht, .inc files within the last 90 days; forensically preserve suspicious files before deletion.
   • Enumerate all Super User and admin accounts on affected Joomla instances for unexpected additions, rotate passwords, and invalidate API tokens and session cookies.
   • Isolate internet-facing Joomla sites with JCE as a priority (temporary maintenance mode via .htaccess IP allow-list) if the patch cannot be rolled out within 4 hours.
   • Open an incident ticket referencing CVE-2026-48907 with scope = all Joomla hosts; reconcile the asset inventory against administrator/manifests/files/jce.xml to pin exact versions.
2. 02

   Runbook step 2

   Mitigation layers

   • WAF rule: drop HTTP requests carrying option=com_jce combined with task=plugin, plugin=imgmanager, method=form, or action=upload when no valid Joomla session cookie is present. Additionally reject multipart/form-data uploads whose filename matches \.(php[0-9]?|phar|phtml|pht|inc)$.
   • Web server hardening: disable PHP execution in writable paths — Apache php_admin_flag engine off for /images/, /media/, /tmp/, /cache/; Nginx location ~* /(images|media|tmp)/.*\.php$ { deny all; }.
   • Network segmentation: place Joomla hosts in a dedicated DMZ, enforce default-deny egress so reverse shells cannot phone home to arbitrary external IPs; allow only well-defined destinations (updates, SMTP relay).
   • Filesystem controls: mount webroot read-only where possible, mount upload directories with noexec; separate the webserver user from the Joomla file owner.
   • IAM: restrict /administrator/ to a dedicated admin VLAN or VPN, front with mTLS or HTTP Basic Auth, enforce MFA via a Joomla MFA plugin for all backend accounts.
   • IPS/IDS: enable Snort/Suricata signatures targeting JCE upload exploitation (Emerging Threats ET WEB_SPECIFIC_APPS JCE family) and keep the ET feed current.
3. 03

   Runbook step 3

   Detection rules

   • Web access logs: POST to /index.php with query option=com_jce and HTTP 200, followed within 5 minutes by creation of a new .php file under /images/ or /media/. KQL shape: W3CIISLog | where csUriQuery has "com_jce" and csMethod == "POST" | join (FileCreationEvents | where FileName endswith ".php") on $left.cIP == $right.InitiatingProcessAccountName.
   • Sysmon EID 11 (File Create) inside the Joomla webroot for .php, .phar, .phtml where parent process is w3wp.exe, php-fpm, httpd, or apache2.
   • Linux auditd watch on the webroot (-w /var/www -p wa -k joomla_write), alerting on create events with comm=php-fpm and PHP extensions outside core paths.
   • EDR process ancestry: php-fpm or apache2 spawning sh, bash, python, perl, nc, curl, wget with an outbound network connection — the canonical webshell pivot pattern.
   • Sigma shape: detection: selection: web.request.uri_query|contains: "com_jce" web.request.method: POST web.response.status: 200 condition: selection | count() by src_ip > 5 within 1m to catch exploit scanning.
   • Joomla DB query: SELECT * FROM #__users WHERE registerDate > NOW() - INTERVAL 90 DAY AND block = 0 to surface unexpected admin or editor accounts.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.

Source: BSI CSAF, BSI WID Portal, cvelistv5, pwn.watch, CISA KEV Catalog, NVD (NIST)

Vendors and products

• Widget Factory Joomla Content Editor (JCE) extension for Joomla

Weakness classes (CWE)

• CWE-284Improper Access Control

  Pillar

  The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

  Entry at MITRE CWE-284

References & sources

• joomlacontenteditor.netProduct
• joomlacontenteditor.netWidget Factory Joomla Content Editor — CVE-2026-48907Vendor advisory, pwn-watch
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48907government-resource
• pwn.watchpwn.watch: Widget Factory Joomla Content Editor : Widget Factory Joomla Content Editor Improper Access Control Vulnerabilitypwn-watch
• NVD (NIST)NVD: CVE-2026-48907pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 17.06.2026CISA KEV entry updated9119a7d8…

   4 individual changes: Date Added, Due Date, Required Action, Vulnerability Name

   Show 4 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Date Added	added	—	2026-06-16
   Due Date	added	—	2026-06-16
   Required Action	added	—	2026-06-16
   Vulnerability Name	added	—	2026-06-16

   Source identifier: 9119a7d8-5eab-497f-8521-727c672e3725

One NVD translation into another language is hidden.

Linked advisories

• Recent KEV Additions: LiteSpeed cPanel Plugin, Cisco Catalyst SD-WAN Manager, and Splunk EnterpriseSANS NewsBites14.06.2026