CVE-2026-48907
CISA KEV
ACT NOW
Priority: 0.00
BB Relevance:
10/100
Published: N/A
Modified: N/A
First seen: 2026-10-29
Status: pending_score
Description
Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users.
CISA Known Exploited Vulnerability
Vendor / Product
Widget Factory — Joomla Content Editor
Date Added
2026-06-16
Remediation Due
2026-06-19
https://www.joomlacontenteditor.net/news/jce-security-update-and-a-free-patch-for-older-sites ; https://www.joomlacontenteditor.net/support/changelog/editor ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48907
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| widgetfactorylimited | jce | < 2.9.99.5 |
References & Advisories (3)
US Government Resource
Release Notes
Vendor Advisory
Product