Is CVE-2026-48907 exploited in the wild?

Yes. CVE-2026-48907 is known to be exploited in the wild, first recorded on 16 June 2026. Treat it as urgent.

How severe is CVE-2026-48907?

Critical severity, with a CVSS score of 10, published 5 June 2026.

Which products and versions are affected?

Joomla! Project JCE Editor All versions prior to patch.

Is there a fix for CVE-2026-48907?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-48907 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-48907?

Check whether you run Joomla! Project JCE Editor or Widget Factory Joomla Content Editor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48907: Joomla JCE Editor improper access control leading to RCE

CVE-2026-48907 · Severity: critical · CVSS 10 · Exploited in the wild · Published 2026-06-05

A critical security flaw has been identified in the Joomla Content Editor (JCE), a popular tool used to manage website content. This vulnerability allows unauthorized individuals to bypass security controls and upload malicious files to the web server. If exploited, an attacker could take complete control of the website, potentially leading to data theft, service disruption, or the installation of further malware. This issue is reportedly being actively exploited in the wild.

Vendors: Joomla! Project.

Quick answers

Is CVE-2026-48907 exploited in the wild?: Yes. CVE-2026-48907 is known to be exploited in the wild, first recorded on 16 June 2026. Treat it as urgent.
How severe is CVE-2026-48907?: Critical severity, with a CVSS score of 10, published 5 June 2026.
Which products and versions are affected?: Joomla! Project JCE Editor All versions prior to patch.
Is there a fix for CVE-2026-48907?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-48907 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-48907?: Check whether you run Joomla! Project JCE Editor or Widget Factory Joomla Content Editor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper access control vulnerability (CWE-284) exists in the JCE editor extension for Joomla. The flaw allows unauthenticated remote attackers to create new editor profiles, which can then be leveraged to bypass file upload restrictions. By exploiting this, an attacker can upload and execute arbitrary PHP code on the server, leading to full remote code execution (RCE). The vulnerability is confirmed to be exploited in the wild, and users are advised to apply the security updates provided by the vendor immediately.

Affected products

Widget Factory Joomla Content Editor (JCE) extension

Timeline

2026-06-05: disclosed
2026-06-16: advisory: NVD record updated with CISA-ADP enrichment
2026-06-16: exploited: Reported as exploited in the wild in advisory metadata

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.