CVE-2026-48907

Improper Access Control in Widget Factory Joomla Content Editor. CISA confirmed attackers exploit it and added it to its Known Exploited Vulnerabilities catalog on 16 June 2026.

Product: Widget Factory Joomla Content Editor
Added to CISA's catalog: 16 June 2026
Federal fix-by date: 19 June 2026
Ransomware: No known use in ransomware campaigns
Vendor advisories: www.joomlacontenteditor.net/news/jce-security-update-and-a-free-patch-for-older-sites
www.joomlacontenteditor.net/support/changelog/editor
Sources: CISA’s catalog, NVD entry

CISA’s description.

Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users.

Every flaw CISA confirmed exploited in the last 30 days is on the exploit watch. This is not security advice. Check the vendor’s advisory before acting. From CISA’s catalog of 4 November 2026.