CVE-2026-48907

The flaw stems from improper access control (CWE-284) in the JCE editor profile management mechanism. An unauthenticated attacker can send a specially crafted request to the application and create a new editor profile without having an account in the system. Subsequently, by using the created profile, the attacker is able to upload a PHP file to the server and trigger its execution — which in practice means gaining remote code execution (RCE) on the server hosting the Joomla application.

An attacker can gain full control over the server through remote PHP code execution (RCE), enabling data theft, backdoor installation, lateral movement in the network, and complete takeover of the application and operating system.

Patches available from the vendor should be applied immediately in accordance with references published at https://www.joomlacontenteditor.net/. Until updates are deployed, it is recommended to disable the JCE extension or restrict access to the Joomla instance at the firewall/web server level. Server logs should also be reviewed for unauthorized editor profile creation requests and the presence of suspicious PHP files in application directories.

JCE Editor extension for the Joomla CMS — specific versions indicated in vendor references (https://www.joomlacontenteditor.net/)

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users.