CVE-2026-48907

Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

Published Jun 5, 2026 CVSS 4.0 · 10 Critical EPSS 85.4% KEV · Listed

Description

A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.

Analysis

Technical impact

This vulnerability, a CWE‑284 Improper Authorization flaw, in the Joomla Content Editor (JCE) extension permits unauthenticated users to create new editor profiles that allow PHP code uploading and execution, giving an attacker the ability to run arbitrary code on the web server.

Affected Systems

The vulnerability affects the JCE extension for Joomla shipped by joomlacontenteditor.net. All installations using JCE versions prior to 2.9.99.5 are susceptible.

Risk and Exploitability

The issue is rated with a CVSS score of 10, indicating critical severity. The EPSS score is 85%, indicating a high exploitation probability, and the vulnerability is listed in CISA KEV. Its remote, unauthenticated nature means an attacker can exploit it without credential or prior access, potentially taking full control of the affected system.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

joomlacontenteditor.net

Joomla Content Editor (JCE) extension for Joomla

unaffected

Version	Status	Constraints
`1.0.0-2.9.99.4`	affected	—

Configuration 1 [-]

cpe:2.3:a:widgetfactorylimited:jce:*:*:*:*:*:joomla\!:*:*

No data.

Vendor Product Versions

Joomlacontenteditor.net

Joomla Content Editor (jce) Extension For Joomla

Version	Status	Scheme	Platform
`[1.0.0,2.9.99.4]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Joomla Content Editor (JCE) extension to version 2.9.99.5 or later.
If upgrading is not immediately possible, disable or remove the JCE extension from the site to block the upload path.
If disabling is not an option, reconfigure the JCE plugin to restrict editor profile creation and file uploads to authenticated administrators only.

Generated by OpenCVE AI on October 25, 2026 at 18:59 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is in the KEV database since June 16, 2026.

Exploit prediction score: 85.4% (85.439% probability within 30 days)

Exploitation active

Automatable yes

Technical Impact total

References

Link	Providers
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48907
https://www.joomlacontenteditor.net/
https://www.joomlacontenteditor.net/news/jce-security-update-and-a-free-patch-for-older-sites

History

Jun 16, 2026 8:30 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48907
Metrics	ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`	ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 16, 2026 7:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		kev `{'dateAdded': '2026-06-16T00:00:00+00:00', 'dueDate': '2026-06-19T00:00:00+00:00'}`

Jun 16, 2026 7:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://www.joomlacontenteditor.net/news/jce-security-update-and-a-free-patch-for-older-sites

Jun 5, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 5, 2026 10:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Joomlacontenteditor.net Joomlacontenteditor.net joomla Content Editor (jce) Extension For Joomla
Vendors & Products		Joomlacontenteditor.net Joomlacontenteditor.net joomla Content Editor (jce) Extension For Joomla

Jun 5, 2026 8:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.
Title		Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
Weaknesses		CWE-284
References		https://www.joomlacontenteditor.net/
Metrics		cvssV4_0 `{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red'}`