A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.

Reports indicate this vulnerability in the Widget Factory Joomla Content Editor (JCE) plugin has been exploited in the wild. Apply the available patch as soon as possible.

Joomla! Content Editor (JCE) is a popular WYSIWYG editor for Joomla! websites. Versions prior to 2.9.99.5 contain a critical vulnerability that allows unauthenticated users to create new editor profiles, which can lead to unrestricted file upload and remote code execution.

The version of the JCE (Joomla Content Editor) extension for the Joomla! application running on the remote host is prior to 2.9.99.5. It is, therefore, affected by an improper access control vulnerability. The extension allows the creation of new editor profiles for unauthenticated users, ultimately resulting in the upload and execution of arbitrary PHP code.

Note that Nessus has not tested for this issue but has instead relied only on the extension's self-reported version number.

ID	Name	Product	Family	Type	Severity
115270	Joomla! JCE < 2.9.99.5 Unrestricted File Upload	Web App Scanning	Component Vulnerability	Check Based	critical
321523	Joomla! Extension 'JCE' < 2.9.99.5 Remote Code Execution	Nessus	CGI abuses	Remote	critical

Detections

Analytics

CVE-2026-48907

critical

Tenable Plugins

critical

critical