Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

AdGuard blocks Joomla exploit and launches email tracking shield

Part of the CVE-2026-48907 story · since 16 Jun

Quiet for 20 weekslast report 17 Jun6 articles4 outlets
16 Jun · CISA first3 Aug27 Aug20 SepNowThis article5th of 6
  • Tue 16 Jun, 20:50 UTC. CISA, first report. CISA adds critical Joomla editor flaw CVE-2026-48907 to KEV. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 21:37 UTC. CISA. CISA Adds CVE-2026-48907 Joomla Editor Flaw to Known Exploited List. Cites a CVE in CISA KEV.
  • Wed 17 Jun, 07:21 UTC. SecurityOnline, its first report on the story. WooCommerce stores hit by payment skimmer (CVE-2026-48907). Cites a CVE in CISA KEV.
  • Wed 17 Jun, 07:50 UTC. SecurityWeek, its first report on the story. Joomla and LiteSpeed Bugs Let Attackers Run Code, Gain Root. Cites a CVE in CISA KEV.
  • Wed 17 Jun, 08:25 UTC. SecurityOnline. AdGuard blocks Joomla exploit and launches email tracking shield. Cites a CVE in CISA KEV. This article, 5th of 6.
  • Wed 17 Jun, 15:40 UTC. Security Affairs, its first report on the story. CISA flags critical Joomla JCE bug enabling remote code execution. Cites a CVE in CISA KEV.

The recent alert from AdGuard highlights the detection of an exploit (CVE-2026-48907) in the Joomla Content Editor related to improper access control. Additionally, AdGuard has introduced a feature in its ad-blocking software aimed at preventing tracking via hidden 1x1 pixel images commonly used in email marketing. These pixels allow marketers to monitor email interaction without users' knowledge.

AdGuard's tracking shield, which must be manually activated, is compatible with several email clients and will soon be available for mobile platforms. The update caters to various email applications, ensuring robust privacy protection against such tracking attempts.

How the story developed

All 6 articles
Quiet for 20 weekslast report 17 Jun6 articles4 outlets

6 articles from 4 outlets since 16 Jun. Quiet since 17 Jun. This was the 5th report, 12 hours after the first.

Now16 Jun1718191 Nov2First reportCISA · 16 Jun, 20:50This article5th of 6 · day 1
  • Tue 16 Jun, 20:50 UTC. CISA, first report. CISA adds critical Joomla editor flaw CVE-2026-48907 to KEV. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 21:37 UTC. CISA. CISA Adds CVE-2026-48907 Joomla Editor Flaw to Known Exploited List. Cites a CVE in CISA KEV.
  • Wed 17 Jun, 07:21 UTC. SecurityOnline, its first report on the story. WooCommerce stores hit by payment skimmer (CVE-2026-48907). Cites a CVE in CISA KEV.
  • Wed 17 Jun, 07:50 UTC. SecurityWeek, its first report on the story. Joomla and LiteSpeed Bugs Let Attackers Run Code, Gain Root. Cites a CVE in CISA KEV.
  • Wed 17 Jun, 08:25 UTC. SecurityOnline. AdGuard blocks Joomla exploit and launches email tracking shield. Cites a CVE in CISA KEV. This article, 5th of 6.
  • Wed 17 Jun, 15:40 UTC. Security Affairs, its first report on the story. CISA flags critical Joomla JCE bug enabling remote code execution. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 6 articles as a list
  1. Tue 16 JunDay 02
    1. CISA adds critical Joomla editor flaw CVE-2026-48907 to KEV20:50 · CISA · official · First report · CISA alert · Known exploited CVE
    2. CISA Adds CVE-2026-48907 Joomla Editor Flaw to Known Exploited List21:37 · CISA · official · Known exploited CVE
  2. Wed 17 JunDay 14
    1. WooCommerce stores hit by payment skimmer (CVE-2026-48907)07:21 · SecurityOnline · Known exploited CVE
    2. Joomla and LiteSpeed Bugs Let Attackers Run Code, Gain Root07:50 · SecurityWeek · Known exploited CVE
    3. AdGuard blocks Joomla exploit and launches email tracking shield08:25 · SecurityOnline · Known exploited CVE · This article, 5th of 6
    4. CISA flags critical Joomla JCE bug enabling remote code execution15:40 · Security Affairs · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in