Summary
CISA has added a maximum-severity vulnerability in the Widget Factory Joomla Content Editor (JCE) extension to its Known Exploited Vulnerabilities catalog, citing active exploitation in the wild. CVE-2026-48907, which carries a perfect CVSS score of 10.0, is an improper access control flaw that allows unauthenticated attackers to create new editor profiles, upload arbitrary PHP files, and execute code on the server — effectively granting full site compromise with zero authentication required.
The vulnerability affects JCE versions 1.0.0 through 2.9.99.4 and was patched in version 2.9.99.5 on June 3, with additional hardening in version 2.9.99.6 on June 6. CISA has set a June 19 deadline for Federal Civilian Executive Branch agencies to remediate. Joomla has warned that automated exploit code is publicly available and even sites without public registration are at risk.
Administrators of compromised sites are advised that simply updating JCE closes the entry point but does not clean an already-compromised installation. Post-compromise steps include backing up rogue profiles, deleting attacker-created accounts, rotating all credentials, and performing a full server-side malware scan.
Source
The Hacker News — CISA Warns of Actively Exploited Joomla JCE Flaw · CISA Alert (June 16, 2026) · BleepingComputer
Commentary
A CVSS 10.0 is as bad as it gets, and the combination of unauthenticated access, trivial exploitation, and publicly available exploit code makes this one particularly urgent. JCE is one of the most widely installed Joomla editor plugins, so the attack surface is massive — any Joomla site that hasn’t updated in the past two weeks is a sitting duck.
What makes this worse is the remediation gap: patching alone isn’t enough if you’re already compromised, and many small site operators won’t know to check for rogue profiles or planted backdoors. If you run Joomla, drop everything and update. Then check your editor profiles for anything you didn’t create.