PT-2026-46908

CVE-2026-48907

Published

2026-06-03

Updated

2026-10-31

Description by

CVSS 2.0

Critical

MetricsAV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Widget Factory Joomla Content Editor (JCE) versions 1.0.0 through 2.9.99.4

Description Improper access control in the JCE editor extension for Joomla allows unauthenticated users to create new editor profiles. This flaw enables the upload and execution of arbitrary PHP code on the affected server, which can be leveraged to install web shells and establish persistent backdoors for full site compromise.

Recommendations Update Widget Factory Joomla Content Editor (JCE) to version 2.9.99.5.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-284: Improper Access Control

Related identifiers

CVE-2026-48907