CVE-2026-48907 CRITICAL

CVE-2026-48907: Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5

Vendor Joomlacontenteditor.net
Product Joomla Content Editor (JCE) extension for Joomla
Weakness CWE-284
KEV Status Known Exploited
Published June 5, 2026
Last update June 5, 2026
View on NVD All CVEs

CVSS base score

10.0/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red

What the vulnerability does

01Description

A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.

Explanation of Vulnerability in Simple Terms

02Summary

The JCE extension for Joomla contains an access control vulnerability that allows unauthenticated attackers to read, modify, or delete sensitive data and functionality on affected sites. The vulnerability requires only network access and can be exploited without user interaction. This affects all versions from 1.0.0 through 2.9.99.4.

What an attacker can do

03Attacker Capabilities

Read, modify, or delete site data and functionality without authentication.

Potential impact on your site

04Site Impact

Attackers can compromise site content, user data, and editor functionality without logging in.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

CISA mandated remediation

06CISA Required Action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Key dates

07Disclosure timeline

June 5, 2026 CVE published
June 5, 2026 Record updated

External resources

08References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-48907 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/284.html AskarLabs — CWE-284 write-up Improper Access Control CISA KEV Reference https://www.joomlacontenteditor.net/news/jce-security-update-a… CISA KEV Reference https://www.joomlacontenteditor.net/support/changelog/editor CISA KEV Reference https://www.cisa.gov/news-events/directives/bod-26-04-prioriti… CISA KEV Reference https://www.cisa.gov/news-events/directives/bod-26-04-implemen… CISA KEV Reference https://nvd.nist.gov/vuln/detail/CVE-2026-48907

Related vulnerabilities

09Related CVE

CVE-2024-11868 LearnPress – WordPress LMS Plugin <= 4.2.7.3 - Course Material Sensitive Information Exposure via REST API CVE-2024-12370 WP Hotel Booking <= 2.1.5 - Missing Authorization CVE-2024-13430 Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Authenticated (Contributor+) Private Post Disclosure in pagelayer_builder_posts_shortcode CVE-2025-25225 Extension - hikashop.com - Privilege escalation vulnerability Hikashop component version 1.0.0 - 5.1.3 for Joomla CVE-2025-14977 Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 4.2.4 - Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information Disclosure