Joomla JCE CVE-2026-48907: Exploited Profile Import RCE

What to do

1. Check the JCE version on every Joomla site, including staging copies and client sites you host.
2. Update to the current JCE release (2.9.99.12 or 3.0.2 as of Oct 23, 2026); if you cannot, apply the vendor's free patch or uninstall JCE.
3. Open Components: JCE Editor: Editor Profiles and delete any profile you did not create; check permitted file extensions for php, phtml or txt.
4. Remove web shells, or restore from a backup taken before the first unauthenticated profiles.import request in your logs.
5. Rotate Joomla administrator passwords, the database password in configuration.php and any other stored secrets.
6. Block unauthenticated requests to option=com_jce&task=profiles.import at the WAF as an extra layer.

How to check if you are affected or compromised

• Search access logs for unauthenticated POSTs to option=com_jce&task=profiles.import, especially followed by a POST with method=upload, both returning 200.
• Look for editor profiles with machine-generated names such as J940401, labels like Pwned or RCE via JCE, or an ordering of -99999.
• Find .xml.php droppers, eval(gzinflate(base64_decode( blobs and Nxploited marker files under images, media, tmp and libraries.
• Review the Super Users group for administrators nobody on your team created.

What happened#

On June 3, 2026, Widget Factory released 2.9.99.5 of JCE, its content editor extension for Joomla. Its changelog lists CVE-2026-48907: "Insufficient access controls permitted unauthenticated users to upload editor profiles." The CVE record, published June 5 by Joomla's CNA, says this ends in "PHP code upload and execution." It scores CVSS 4.0 10.0. NVD rates it 9.8 on CVSS 3.1.

The entry point is the profile import task, index.php?option=com_jce&task=profiles.import, which answered without a login. Per mySites.guru, attackers "Import a rogue profile that re-enables php and txt uploads with MIME validation switched off," then upload a web shell through it. mySites.guru says working exploit code went public on GitHub on June 9. The vendor's June 12 advisory says "the attacks are automated" and warns that a site "with no public registration is not safe." CISA added the bug to the KEV catalog on June 16, due June 19.

Who is affected#

The CVE record lists JCE 1.0.0 through 2.9.99.4. mySites.guru says JCE Core and Pro are both affected on Joomla 3, 4, 5 and 6. The vendor says 2.6.x "does not appear to be affected in a default configuration," though this is unverified. Version 2.9.99.6 (June 8) added hardening, and Beazley Security and mySites.guru treat it as the minimum. The current releases are 2.9.99.12 and 3.0.2, both from October 7, 2026. For sites that cannot update, the vendor offers a free stopgap patch for JCE 2.7.x, 2.8.x and 2.9.x. It lacks later hardening and cleans nothing.

JCE was the first of five Joomla extensions CISA added to KEV this summer; SP Page Builder, Page Builder CK, iCagenda and Balbooa Forms followed in July. No source reviewed ties them to one campaign.

Do you really need to act?#

Yes, if any site you run is on 2.9.99.4 or older. The bug needs no account and no special setup, and the vendor says the attacks are automated. As The Hacker News reported, updating "closes the entry point but does not clean a site that was already compromised." mySites.guru says that once a shell is in place, attackers can add super administrators, change files and download the database. If a site ran a vulnerable version after early June, assume it was hit until checked.

What to do now#

1. Check the installed JCE version on every site (Extensions: Manage).
2. Update to 2.9.99.12 or 3.0.2. If you cannot, apply the vendor's patch or uninstall JCE.
3. Open Components, JCE Editor, Editor Profiles. Delete profiles you did not create, and check the permitted file extensions in Image Manager and File Browser for php, phtml or txt.
4. Remove web shells, or restore from a backup taken before the first malicious import request.
5. Rotate admin passwords, the database password in configuration.php and any API keys the site stores.

How to tell if you were hit#

Run grep -E 'com_jce.*task=profiles\.import' access.log*. mySites.guru describes the attack as an unauthenticated import POST followed by a method=upload POST, both returning 200, "often carrying an id=RCExxx marker." The vendor says the earliest match shows when the site was first reached. Look for profiles with generated names such as J940401, labels like "Pwned" or "RCE via JCE," or an ordering of -99999. On disk, run find images media tmp libraries -name '*.php*' -newermt 2026-06-01 and grep -rl 'gzinflate(base64_decode' images media tmp libraries. Hidden .xml.php droppers and "Nxploited" marker files are also signs. Check the Super Users group for unknown administrators.

Timeline#

• Jun 3, 2026 — JCE 2.9.99.5 fixes CVE-2026-48907.
• Jun 5, 2026 — The CVE is published (CVSS 4.0 10.0).
• Jun 9, 2026 — Working exploit code appears on GitHub, per mySites.guru.
• Jun 12, 2026 — The vendor publishes its advisory and a free patch for older versions.
• Jun 16, 2026 — CISA adds the CVE to KEV, due June 19.
• Oct 7, 2026 — JCE 2.9.99.12 and 3.0.2, the current releases, ship.

Vulnerability records

• CVE-2026-48907 · KEV 2026-06-16 · A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. JCE (Widget Factory) — JCE Security Update and a Free Patch for Older Sites joomlacontenteditor.net
2. JCE — Editor changelog 2.x joomlacontenteditor.net
3. JCE — Editor changelog 3.0.x joomlacontenteditor.net
4. CVE record — CVE-2026-48907 cve.org
5. NVD — CVE-2026-48907 nvd.nist.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2026-48907 cisa.gov
7. mySites.guru — The JCE hack: rogue profiles and web shells mysites.guru
8. mySites.guru — CVE-2026-48907 mysites.guru
9. Beazley Security Labs — BSL-A1181: Critical Vulnerability in Content Editor Extension for Joomla (CVE-2026-48907) labs.beazley.security
10. Falcon Internet — Joomla JCE CVE-2026-48907: unauthenticated RCE and web shells falconinternet.net

Coverage and analysis

1. The Hacker News — CISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code Execution thehackernews.com