U.S. CISA adds Widget Factory Joomla Content Editor (JCE) flaw to its Known Exploited Vulnerabilities catalog

CVE-2026-48907 is an improper access control flaw (CWE-284) in the Joomla Content Editor (JCE) extension from Widget Factory Limited that allows unauthenticated users to create new editor profiles. Because these profiles can confer file-upload privileges, an attacker can reach the editor's upload functionality without logging in, upload malicious PHP files, and have the web server execute them, resulting in unauthenticated remote code execution with high impact on system confidentiality, integrity, and availability (CVSS 4.0 score of 10). Any Joomla site running the affected JCE extension is exposed, with internet-facing sites most at risk. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-16, confirming in-the-wild exploitation, and EPSS assigns a 78.1% probability of exploitation within 30 days (100th percentile). No public proof-of-concept is known, but CISA and Australian authorities have warned of active CMS exploitation targeting this flaw.

Do: Apply the latest JCE update per Widget Factory Limited's vendor instructions, in line with CISA BOD 26-04 requirements (federal agencies must patch or discontinue use of the product if mitigations are unavailable). Until patched, verify whether unauthenticated users can create editor profiles in your JCE configuration, restrict access to the extension, and inspect webroots and logs for unexpected PHP file uploads. Given confirmed active exploitation and a very high EPSS score, prioritize internet-facing Joomla sites immediately.