Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CWECWE-284
Descriptions
KEV: Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users.
Hunt for unauthenticated HTTP requests to index.php?option=com_jce&task=profiles.import in Joomla sites targeting editor profile creation leading to PHP code upload and web shell deployment.
PreconditionsNetwork accessibility to a Joomla site with JCE extension versions 1.0.0 through 2.9.99.4. No authentication required. Attacker sends crafted HTTP POST to the profile import task to create a rogue editor profile with PHP code execution capabilities. agent
Exploit notesCVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Unauthenticated exploitation via crafted HTTP POST to index.php?option=com_jce&task=profiles.import. Attacker creates a rogue editor profile that permits PHP code upload, then deploys a web shell. Automated scanning observed. Updating to 2.9.99.5 closes the entry point but does NOT clean sites already compromised.
SummaryCVE-2026-48907 is a maximum-severity (CVSS 10.0) improper access control vulnerability (CWE-284) in Widget Factory Joomla Content Editor (JCE) extension versions 1.0.0 through 2.9.99.4. Unauthenticated attackers can create new editor profiles via HTTP POST to the profiles.import task, enabling PHP code upload and execution via web shells. Public exploit code available with automated attacks confirmed in the wild. Patched in JCE 2.9.99.5. Sites already compromised require forensic cleanup beyond patching.
Tia coverage
First reported2026-07-12
First exploit report2026-06-17
Exploit report → KEV1 days after the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.