CVE-2026-48907
Widget Factory Joomla Content Editor Improper Access Control Vulnerability
Description
CVE-2026-48907 is a critical improper access control vulnerability in the JCE (Joomla Content Editor) extension for Joomla, developed by Widget Factory. The flaw allows the creation of new editor profiles for unauthenticated users, which ultimately enables PHP code upload and execution on the server. Because an unauthenticated attacker can reach functionality that should be restricted, CVE-2026-48907 leads to full remote code execution on affected Joomla sites. It is rated CVSS 9.8 (Critical), listed in the CISA KEV catalog, and affects Joomla Content Editor versions before 2.9.99.5. Any Joomla site running a vulnerable JCE version should update immediately, as this access control vulnerability provides a direct route to site takeover.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| widgetfactorylimited | jce | < 2.9.99.5 |
References
- https://www.joomlacontenteditor.net/(Product)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48907(US Government Resource)
- https://www.joomlacontenteditor.net/news/jce-security-update-and-a-free-patch-for-older-sites(Release Notes, Vendor Advisory)
Weakness Type
CWE-284: Improper Access Control
CVE-2026-48907 is classified under CWE-284 — Improper Access Control. The JCE extension does not properly restrict who may create editor profiles, so an unauthorized, unauthenticated actor can perform an action that should require an authenticated, privileged account. This broken access control is what allows the attacker to reconfigure the editor and proceed to upload and execute PHP code.
Learn more: CWE-284 — Improper Access Control
Impact Analysis
CVE-2026-48907 carries a CVSS 3.1 base score of 9.8 (Critical). Attack Vector (Network): the vulnerable functionality is reachable remotely over HTTP. Attack Complexity (Low): no special conditions are required. Privileges Required (None) and User Interaction (None): the attacker needs no account and no victim action. Confidentiality, Integrity and Availability (High): because the chain ends in PHP code upload and execution, an attacker gains arbitrary code execution on the web server, allowing full compromise of the site, its database, and any data it processes. With an EPSS score of about 6.9% (93rd percentile) and confirmed active exploitation, vulnerable Joomla sites face a high and immediate risk of complete takeover.
Exploit Maturity
CISA has added CVE-2026-48907 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The references do not include a dedicated public exploit link, but the EPSS score of about 6.9% (93rd percentile) indicates a high probability of exploitation, consistent with the confirmed in-the-wild activity. Because the vulnerability is unauthenticated and yields PHP code execution, defenders should assume working exploits are circulating and patch without delay.
Remediation
- Follow the vendor's required action and update the Joomla Content Editor (JCE) extension to version 2.9.99.5 or later; Widget Factory also published a free patch for older sites.
- If you cannot update immediately, restrict access to the JCE administrative and profile endpoints (for example via web server access rules) until the patch is applied.
- Inspect the web root and upload directories for unexpected PHP files and remove any web shells; assume compromise if a vulnerable version was internet-exposed.
- Review web server and Joomla logs for unauthenticated profile creation and suspicious file uploads to identify prior exploitation.
- As long-term hardening, enforce least-privilege access control on all editor and upload functionality and disallow execution of PHP within user-writable upload directories.
Technical Details
The vulnerability is an instance of CWE-284 (Improper Access Control): the JCE extension fails to enforce authorization on the creation of editor profiles, treating a privileged configuration action as if it were public. With the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, an unauthenticated attacker sends crafted HTTP requests to create an editor profile that permits arbitrary file types, then uploads a PHP file and triggers its execution. The result is server-side code execution in the context of the web application, turning a missing access control check into full remote code execution.
Frequently Asked Questions
Is CVE-2026-48907 being actively exploited?
Yes. CVE-2026-48907 is listed in CISA's Known Exploited Vulnerabilities catalog, confirming active exploitation. Its EPSS score of about 6.9% (93rd percentile) further indicates a high likelihood of attack.
What products are affected by CVE-2026-48907?
The Joomla Content Editor (JCE) extension for Joomla, by Widget Factory, in versions before 2.9.99.5 is affected.
How do I fix CVE-2026-48907?
Update the JCE extension to version 2.9.99.5 or later, or apply the vendor's free patch for older sites. Then check your site for any PHP files or web shells uploaded during prior exploitation.
How severe is CVE-2026-48907?
It is rated Critical with a CVSS 3.1 base score of 9.8. Because it is unauthenticated, network-reachable, leads to PHP code execution, and is actively exploited, it should be remediated immediately.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.