Security Brief: CISA flags exploited Joomla JCE plugin
https://vulnify.app/blog/security-brief-cisa-jce-joomla-plugin

CISA added CVE-2026-48907 in Joomla Content Editor (JCE) to the KEV catalog. Update JCE past 2.9.99.4, look for unexpected editor profiles, and treat a patched site as unclean until you check it.

CISA put a Joomla Content Editor (JCE) flaw on its Known Exploited Vulnerabilities list and told U.S. civilian agencies to treat it as an urgent patch. Private site owners are not under that federal clock, but the same plugin sits on ordinary Joomla sites. If you still run JCE 2.9.99.4 or older, assume the editor is an open door until you update and look for leftovers. What happened CVE-2026-48907 is an improper access control bug in Widget Factory’s JCE extension. CISA’s 16 June 2026 alert says unauthenticated users can create new editor profiles and, through that, upload and run PHP. The agency added the CVE to the KEV catalog that day and set a 19 June 2026 due date for Federal Civilian Executive Branch systems under Binding Operational Directive 26-04. Severity scores do not agree: NVD publishes 9.8 under CVSS 3.1, and the Joomla CNA publishes 10.0 under CVSS 4.0. Treat it as a maximum-severity, unauthenticated remote hit either way. The vendor’s own timeline is earlier than the CISA notice. JCE 2.9.99.5 shipped on 3 June 2026 as the first fix for all prior versions. 2.9.99.6 followed on 8 June with extra hardening. Later 2.9.99.8 and 2.9.99.9 builds added more security work. Widget Factory’s June advisory named 2.9.99.9 as the recommended build and says attacks are automated, with public exploit code in circulation. The vendor changelog now lists 2.9.99.10 as current. A site that never offered public registration is not automatically safe. CISA’s deadline was for federal networks. It is useful to owners only as a signal: this is not a theoretical plugin bug. KEV listing means CISA had evidence of real use. The directive also tells agencies to check whether someone got in before the patch. That second step is the one most small Joomla shops skip. Why it matters for website owners JCE is the editor many Joomla sites use to write pages and upload images. If a stranger can add an editor profile, they can change what the site will accept as an upload. That is why CISA’s wording pairs profile creation with PHP execution. A successful hit is not a defaced homepage. It is a foothold on the server that can survive a later plugin update. Widget Factory is explicit on that last point. Updating closes the entry. It does not remove a profile or file that was already planted. If you only bump the version and walk away, an attacker who arrived in early June can still have a working implant in an images or tmp folder. Agencies and freelancers who look after several Joomla hosts should inventory every copy, including staging. Work only on sites you operate or have written permission to test. Do not use this brief as a reason to probe someone else’s JCE install. What to check on your site In Joomla, open Extensions or Components and confirm whether JCE Editor is installed. Write down the exact version. Anything through 2.9.99.4 is in the vendor’s affected range. Update to 2.9.99.10 or later if your PHP and Joomla versions allow it. The vendor also published a stopgap patch package for some 2.7.x–2.9.x sites that cannot meet the current build’s PHP 7.4 / Joomla 3.9 floor. That package is a bridge, not a long-term home. If you cannot update and cannot apply the vendor patch, the vendor says to uninstall JCE. Open Components → JCE Editor → Editor Profiles. Look for a profile you did not create, especially one with a generated name or odd upload permissions. Keep a copy before you delete anything, then remove only the stranger profiles after the update is in place. If you find a rogue profile or unexpected PHP under images, media, or tmp, treat the site as compromised: change administrator, database, and hosting passwords, and ask the host for a server-side malware scan. The update alone is not cleanup. Search access logs for JCE profile-import requests. The vendor published that log hunt; use it on hosts you own. Many hosts keep logs only a short time. Run the Joomla Stack Checker on the public hostname, then the Joomla Vulnerability Scanner landing flow. Follow with a broader website vulnerability scanner pass for leftover admin paths. Related reading Security Brief: Exploit in Joomla JCE Enables PHP Code Execution — earlier Vulnify note on the same CVE. How to scan a website for vulnerabilities — a practical order of checks after a CMS extension patch. OWASP Top 10 explained (2025) — where broken access control sits for site owners. Sources CISA — Adds one known exploited vulnerability to catalog (16 June 2026) Widget Factory — JCE security update, and a free patch for older sites