SecurityOnlineDo Son
WooCommerce stores hit by payment skimmer (CVE-2026-48907)
Part of the CVE-2026-48907 story · since 16 Jun
- Tue 16 Jun, 20:50 UTC. CISA, first report. CISA adds critical Joomla editor flaw CVE-2026-48907 to KEV. Cites a CVE in CISA KEV.
- Tue 16 Jun, 21:37 UTC. CISA. CISA Adds CVE-2026-48907 Joomla Editor Flaw to Known Exploited List. Cites a CVE in CISA KEV.
- Wed 17 Jun, 07:21 UTC. SecurityOnline, its first report on the story. WooCommerce stores hit by payment skimmer (CVE-2026-48907). Cites a CVE in CISA KEV. This article, 3rd of 6.
- Wed 17 Jun, 07:50 UTC. SecurityWeek, its first report on the story. Joomla and LiteSpeed Bugs Let Attackers Run Code, Gain Root. Cites a CVE in CISA KEV.
- Wed 17 Jun, 08:25 UTC. SecurityOnline. AdGuard blocks Joomla exploit and launches email tracking shield. Cites a CVE in CISA KEV.
- Wed 17 Jun, 15:40 UTC. Security Affairs, its first report on the story. CISA flags critical Joomla JCE bug enabling remote code execution. Cites a CVE in CISA KEV.
A critical alert highlights the discovery of a WooCommerce payment skimmer (CVE-2026-48907) that compromises online stores by stealing card details during legitimate transactions. Cybercriminals have shifted from phishing tactics to directly targeting e-commerce sites, injecting JavaScript skimmers into checkout pages. The skimmer mimics the Stripe payment form, capturing sensitive data such as card numbers and CVVs while remaining undetectable to the user.
It disguises its presence, storing data using common tracking keys and encoding stolen information to evade detection. This stealthy method makes it difficult to identify the theft, with dwell times often lasting months. Merchants are urged to implement security measures against this evolving threat.
How the story developed
6 articles from 4 outlets since 16 Jun. Quiet since 17 Jun. This was the 3rd report, 11 hours after the first.
- Tue 16 Jun, 20:50 UTC. CISA, first report. CISA adds critical Joomla editor flaw CVE-2026-48907 to KEV. Cites a CVE in CISA KEV.
- Tue 16 Jun, 21:37 UTC. CISA. CISA Adds CVE-2026-48907 Joomla Editor Flaw to Known Exploited List. Cites a CVE in CISA KEV.
- Wed 17 Jun, 07:21 UTC. SecurityOnline, its first report on the story. WooCommerce stores hit by payment skimmer (CVE-2026-48907). Cites a CVE in CISA KEV. This article, 3rd of 6.
- Wed 17 Jun, 07:50 UTC. SecurityWeek, its first report on the story. Joomla and LiteSpeed Bugs Let Attackers Run Code, Gain Root. Cites a CVE in CISA KEV.
- Wed 17 Jun, 08:25 UTC. SecurityOnline. AdGuard blocks Joomla exploit and launches email tracking shield. Cites a CVE in CISA KEV.
- Wed 17 Jun, 15:40 UTC. Security Affairs, its first report on the story. CISA flags critical Joomla JCE bug enabling remote code execution. Cites a CVE in CISA KEV.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
- Quiet time, folded
Show all 6 articles as a listHide the list
- Tue 16 JunDay 02
- CISA adds critical Joomla editor flaw CVE-2026-48907 to KEV20:50 · CISA · official · First report · CISA alert · Known exploited CVE
- CISA Adds CVE-2026-48907 Joomla Editor Flaw to Known Exploited List21:37 · CISA · official · Known exploited CVE
- Wed 17 JunDay 14
- WooCommerce stores hit by payment skimmer (CVE-2026-48907)07:21 · SecurityOnline · Known exploited CVE · This article, 3rd of 6
- Joomla and LiteSpeed Bugs Let Attackers Run Code, Gain Root07:50 · SecurityWeek · Known exploited CVE
- AdGuard blocks Joomla exploit and launches email tracking shield08:25 · SecurityOnline · Known exploited CVE
- CISA flags critical Joomla JCE bug enabling remote code execution15:40 · Security Affairs · Known exploited CVE