Joomla JCE CVE-2026-48907: 2.5 Million Sites Open to Unauthenticated Code Execution

CVE-2026-48907 exploits a logical flaw in how JCE handles editor profile imports. The Joomla Content Editor stores configuration settings such as allowed file types, upload directories, and user permissions inside editor profiles. The profile import function does not verify whether the requesting user holds a valid authenticated session before processing the profile data.

The attack chain runs in three steps. In step one, the attacker sends an unauthenticated HTTP POST request to index.php?option=com_jce&task=profiles.import. JCE accepts the request, processes the attacker-supplied profile XML, and creates a new editor profile in the Joomla database. The profile is configured with permissive settings that accept PHP file extensions and write to web-accessible directories.

In step two, the attacker triggers JCE's file upload functionality. The newly created rogue profile overrides the normal upload restrictions, allowing a PHP payload to be submitted as if it were a legitimate image or media file. JCE stores the PHP file inside a publicly reachable directory such as images/, media/, or uploads/.

In step three, the attacker sends a GET request to the uploaded file's URL. The web server executes the PHP code with the privileges of the web server process, giving the attacker a persistent remote shell capable of reading server files, executing OS commands, connecting to the database, and installing additional backdoors or malware.

YesWeHack researcher Phil E. Taylor, who documented the full attack chain, noted that "attackers who import a rogue profile can use it to drop a web shell, granting attackers a persistent backdoor on the server." Public proof-of-concept code on GitHub makes the three-step sequence executable by any attacker with basic scripting knowledge. This vulnerability affects every JCE version from 1.0.0 through 2.9.99.4, spanning the full commercial history of the extension.

Every Joomla site running the JCE extension at version 2.9.99.4 or earlier is directly reachable from the public internet right now. The exposure scope is broad because JCE is one of the most widely adopted third-party extensions in the Joomla ecosystem, preferred by administrators for its rich text editing capabilities.

Joomla powers approximately 2.5 million active websites globally, representing roughly 2% of all CMS-powered sites worldwide according to W3Techs data. Because JCE is distributed as a separate extension that administrators install independently, there is no single authoritative count of active JCE installations. Security researchers scanning for the JCE profile import endpoint across Joomla-powered hosts confirmed that exposed instances number in the hundreds of thousands.

The affected population includes government agencies, educational institutions, healthcare portals, e-commerce platforms, and news publications that rely on Joomla as their CMS. Many use JCE specifically because it provides a more capable rich text editor than Joomla's default editor for non-technical content publishers. That legitimate popularity creates a large, predictable attack surface that automated scanners exploit efficiently.

Automated scanning campaigns targeting CVE-2026-48907 were confirmed active within days of CISA's KEV listing on June 16, 2026. CISA's reporting describes widespread scans probing for the JCE profile import endpoint across all internet-accessible Joomla hosts. Any site with JCE installed and publicly accessible is being queried by these campaigns right now.

CISA's June 2026 Known Exploited Vulnerabilities additions signal that federal monitoring has confirmed active exploitation rather than theoretical risk. See our coverage of CISA's June 2026 KEV patch deadlines for the full catalog of current federal remediation requirements.

A PHP web shell installed through CVE-2026-48907 is not a dead-end compromise. Threat actors use the initial foothold for a multi-stage attack sequence.

Credential extraction is the immediate first step. PHP code executing in the Joomla web root can read configuration.php directly, extracting the database host, username, and password in plaintext. Attackers harvest these credentials and reuse them against other internal services or sell them to initial access brokers packaging ransomware affiliate access.

Data exfiltration follows credential extraction. The Joomla database contains user accounts, session tokens, form submissions, and any application data the site processes, which can include personally identifiable information for site registrations, e-commerce transaction records, and internal business data. Attackers compress and exfiltrate this data before triggering any visible ransomware or defacement.

Persistence expansion is a parallel goal. A single web shell in images/ can be used to deploy secondary shells across multiple directories, modify .htaccess files to redirect traffic or inject malicious scripts, or install cron jobs that re-introduce backdoors after initial cleanup. Widget Factory's advisory specifically warns: "updating closes the entry point but does not clean a site that was already compromised." A patch alone is not remediation if exploitation has already occurred.

Lateral movement is the final phase for attackers where the Joomla server is not isolated. Database credentials often reuse passwords across services, the web server process account may have access to shared file systems, and the compromised host can serve as a pivot point for scanning internal network segments. This risk is acute in shared hosting environments where server compromise can affect multiple co-hosted sites.

Detecting exploitation requires checking access logs, the database, and the file system. The attack leaves distinct traces at each of the three stages.

In access logs, search for POST requests containing com_jce and task=profiles.import. Any external IP address that sent a POST to this endpoint after June 3, 2026, should be treated as an exploitation attempt. Requests to JCE's file upload path from the same source IPs represent stage two of the attack chain. Look for URL patterns containing option=com_jce alongside task=plugin and imgmanager strings.

In the Joomla database, query the #__jce_profiles table for any profile not created by a verified administrator. Attackers insert profile records as part of stage one and these records persist even after PHP web shell files are deleted, acting as latent backdoor configuration entries that re-enable upload bypass if the attacker returns.

In the file system, search for PHP files inside web-accessible media directories. The command find /path/to/joomla/images -name "*.php" -type f surfaces any PHP files in the images directory, which should contain only media assets in a clean installation. Extend this check to media/, uploads/, and tmp/ directories. Any PHP file with a creation timestamp after your last verified upload is a web shell candidate.

Common web shell filenames include randomized names designed to blend with legitimate files, as well as generic names like shell.php, c99.php, or names mimicking Joomla component files. Treat any unexpected PHP file in a media directory as confirmed compromise until proven otherwise.

Patching JCE to 2.9.99.5 closes the profile import attack path. Remediation for sites that may already be compromised requires additional steps that the patch alone does not complete.

The update is available through Joomla's standard extension update mechanism. Navigate to Extensions > Manage > Update in the Joomla admin panel, check for updates, and apply the JCE update. If the update does not appear, install version 2.9.99.5 directly from the Widget Factory website. Verify the installed version in Extensions > Manage > Manage after the update completes.

For sites where JCE cannot be updated immediately, a WAF rule blocking POST requests to any URL containing com_jce and task=profiles.import eliminates the attack surface at the network layer. Treat this as a temporary control, not a permanent fix.

This attack class mirrors the pattern of unauthenticated remote code execution vulnerabilities targeting web infrastructure where a single unpatched endpoint on an internet-facing server provides a direct path to full server compromise. The remediation steps below should be completed in order.

CVE-2026-48907 is not a Joomla core vulnerability. It is an extension vulnerability. That distinction matters operationally. Joomla's built-in update notifications cover core software, but extension updates require separate monitoring. Organizations that apply Joomla core patches diligently but lack an extension inventory and update process carry full exposure to CVE-2026-48907 even with a fully current core installation.

The extension attack surface is a documented blind spot in CMS security programs. A 2026 analysis of Joomla compromises found that the majority of successful intrusions targeted extensions rather than Joomla core, because extension code paths receive less security review scrutiny and take longer to patch across the installed base. CVE-2026-48907 follows this pattern: the JCE patch released June 3, but CISA confirmed active exploitation 13 days later, meaning a significant portion of the JCE user base had not updated within two weeks of a critical fix.

For organizations hosting public-facing Joomla sites, the downstream risks extend beyond website defacement. A compromised Joomla server that stores donor data, patient portal links, constituent contact information, or financial records carries breach notification obligations under state privacy laws, HIPAA, and similar frameworks. The cost of a post-exploitation breach notification response consistently exceeds the cost of an extension update program by two to three orders of magnitude.

The remediation window before the weekend is closing. Automated scanning campaigns targeting CVE-2026-48907 do not pause for weekends. Any Joomla site with an unpatched JCE installation that remains accessible carries confirmed active exploitation risk for 48 additional hours before Monday business operations resume. One patch, applied today, eliminates that risk entirely.