Which versions of JCE Joomla Extension are affected by CVE-2026-48907?

The JCE (Joomla Content Editor) extension contains a critical broken-access-control vulnerability (CVE-2026-48907, CVSS 10.0) allowing unauthenticated attackers to upload and execute arbitrary code…

Is there a public PoC exploit available for CVE-2026-48907?

Yes, a public proof-of-concept exploit is available for CVE-2026-48907. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-48907?

Within 24 hours: Identify all Joomla instances with JCE extension active; immediately disable or uninstall JCE if operationally feasible, or restrict network access to Joomla administrative interfaces. Within 7 days: Conduct full forensic audit for indicators of compromise (unauthorized PHP files, suspicious database activity); review access logs for exploitation attempts. Within 30 days: Evaluate long-term alternatives (migrate to alternative Joomla content editor plugins with security track record, or replace Joomla entirely if timeline permits); continuously monitor vendor security advisories for patch release.

JCE Joomla Extension CVE-2026-48907

Q: What is the CVSS score of CVE-2026-48907?

CVE-2026-48907 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red. EPSS exploitation probability: 0.1%.

EUVD-2026-34789 CRITICAL

Improper Access Control (CWE-284)

2026-06-05 Joomla

GHSA-c3f5-4g7f-qjqj

PHP Authentication Bypass Joomla Content Editor Jce Extension For Joomla

10.0

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red

Primary rating from Vendor (Joomla) · only source for this CVE.

CVSS VectorVendor: Joomla

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Added to CISA KEV

Jun 16, 2026 - 20:31 CISA

Analysis Generated

Jun 05, 2026 - 08:30 vuln.today

CVSS changed

Jun 05, 2026 - 08:22 NVD

10.0 (CRITICAL)

CVE Published

Jun 05, 2026 - 07:31 nvd

CRITICAL 10.0

DescriptionCVE.org

A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.

Articles & Coverage 1

POC CVE-2026-48907: Unauthenticated RCE in Joomla JCE Extension < 2.9.99.5 via Profile Import Jun 11, 2026

AnalysisAI

Unauthenticated remote code execution in the JCE (Joomla Content Editor) extension for Joomla allows attackers to create editor profiles without authentication, then leverage that capability to upload and execute arbitrary PHP code on the server. With a CVSS 4.0 score of 10.0 and the CVSS:4.0 'U:Red' urgency flag set by the vendor, this represents a critical broken-access-control flaw, though no public exploit has been identified at time of analysis.

Technical ContextAI

JCE is one of the most widely deployed third-party WYSIWYG editor extensions for the Joomla CMS, providing rich-text editing, media management, and file upload capabilities for content authors. The flaw maps to CWE-284 (Improper Access Control): an administrative function that creates 'editor profiles' - which control which file types, upload paths, and editor features a given user role may access - is exposed without an authentication or authorization check. Because JCE's profile system is what gates its file/media manager (including PHP file extension policies), abusing it lets an attacker self-grant the privileges normally reserved for site administrators, after which the extension's own upload functionality writes attacker-controlled PHP into a web-accessible location for execution by the PHP-FPM/mod_php handler.

RemediationAI

Patch available per vendor advisory: upgrade the JCE extension to the latest release available from https://www.joomlacontenteditor.net/ as the primary fix, since an exact fixed version number was not provided in the supplied data and must be confirmed against the vendor's release notes. Until the upgrade is applied, restrict network access to the Joomla administrator and component endpoints (typically /administrator/ and /index.php?option=com_jce*) using a WAF, reverse-proxy ACL, or IP allowlist - this blocks the unauthenticated profile-creation path but will also prevent legitimate remote content editing. As additional compensating controls, set the webserver to disallow PHP execution under JCE upload directories (e.g., images/, media/) via an .htaccess or nginx location block, and audit existing JCE profiles and the uploads directory for unexpected entries or .php/.phar/.phtml files, recognizing that removing PHP execution from those paths will break any legitimate workflow that relied on it.