Improper access control in the JCE editor extension for Joomla allows unauthenticated users to create new editor profiles. This flaw enables the upload and execution of arbitrary PHP code on the affected server, which can be leveraged to install web shells and establish persistent backdoors for full site compromise.