Critical Joomla JCE editor flaw actively exploited to run PHP code

A critical flaw in the Joomla Content Editor (JCE), one of the most widely used editor extensions for the Joomla CMS, is being actively exploited to take over websites. The bug (CVE-2026-48907, rated a perfect 10) is an access-control failure that lets an unauthenticated attacker create editor profiles and then upload and run arbitrary PHP code, leading to full server compromise. CISA added it to its known-exploited list and ordered federal agencies to patch by June 19. Working exploit code is public and attacks are automated, so even sites with no public registration are at risk. Patching closes the hole but does not remove anything attackers already planted.

Check

Identify Joomla sites using the JCE extension and confirm the version, then audit for unfamiliar editor profiles, suspicious PHP files in upload directories, new admin accounts, and profile-import requests in logs.

Affected

Joomla websites running JCE versions 1.0.0 through 2.9.99.4 (CVE-2026-48907); public-facing sites are being hit by automated attacks regardless of whether public registration is enabled.

Fix

Update JCE to 2.9.99.5 or later now. Since the update does not clean an already-compromised site, also hunt for web shells and rogue accounts, and rotate site, database, and hosting passwords.