CISA Orders Federal Agencies to Patch Actively Exploited Joomla JCE Flaw
Summary
CISA says attackers are actively exploiting CVE-2026-48907, an unauthenticated PHP code execution flaw in the Joomla JCE plugin, and ordered federal agencies to patch by Friday. JCE Pro 2.9.99.6 or later fixes the flaw.
Key points
- CISA added CVE-2026-48907 to its actively exploited vulnerabilities list and ordered Federal Civilian Executive Branch agencies to patch by Friday under BOD 26-04.
- The flaw affects the Widget Factory Joomla Content Editor plugin and can allow unauthenticated attackers to upload and execute PHP code.
- JCE Pro 2.9.99.6 or later addresses the vulnerability; the JCE security team says exploitation is automated and public exploit code is available.
- Updating closes the vulnerable entry point but does not remove attacker access or tools from sites that were already compromised.
- Recommended cleanup includes backing up rogue profiles, updating the plugin, deleting the attacker-created profile, changing passwords, and running a server-side malware scan.
Article Details
- Vulnerability Types
- Improper access control enabling unauthenticated PHP code upload and execution
- Severity
- Maximum severity
- Exploitation Status
- active
- Exploit Availability
- public_exploit
- Patch Status
- available
- Workarounds
- Discontinue use of the product if mitigations are unavailable.
MITRE ATT&CK
CVE
Products
JCE ProAttackers can use the issue to upload and execute PHP code on vulnerable Joomla sites, and JCE Pro 2.9.99.6 or later is required to fix it.JoomlaCISA has ordered federal agencies to urgently patch CVE-2026-48907, a maximum-severity flaw in the Widget Factory Joomla Content Editor (JCE) plugin that is being actively exploited in the wild.Widget Factory Joomla Content Editor (JCE)CISA has ordered federal agencies to urgently patch CVE-2026-48907, a maximum-severity flaw in the Widget Factory Joomla Content Editor (JCE) plugin that is being actively exploited in the wild.