CVE-2026-4890710.0CriticalCWE-284
Widget Factory Joomla Content Editor Improper Access Control Vulnerability
Widget Factory · Joomla Content Editor
Exploited in the wild · in CISA KEV since 16 JunVendor fix available
85.4%probability of exploitation in the next 30 days
99th percentile
050100
Higher than 99% of scored CVEs
10.0CriticalCVSS 4.0
LowMediumHighCrit.
Federal deadline
CISA KEV · added 16 Jun · catalogue entry
Passed 132 days ago
DescriptionNVD
A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Coverage6 articles · 4 outlets
One row per outlet, in order of first report. First in our coverage: CISA, 16 Jun.
Quiet for 19 weekslast report 17 Jun6 articles4 outlets
- Tue 16 Jun, 20:50 UTC. CISA, first report. CISA adds critical Joomla editor flaw CVE-2026-48907 to KEV. Cites a CVE in CISA KEV.
- Tue 16 Jun, 21:37 UTC. CISA. CISA Adds CVE-2026-48907 Joomla Editor Flaw to Known Exploited List. Cites a CVE in CISA KEV.
- Wed 17 Jun, 07:21 UTC. SecurityOnline, its first report on the story. WooCommerce stores hit by payment skimmer (CVE-2026-48907). Cites a CVE in CISA KEV.
- Wed 17 Jun, 07:50 UTC. SecurityWeek, its first report on the story. Joomla and LiteSpeed Bugs Let Attackers Run Code, Gain Root. Cites a CVE in CISA KEV.
- Wed 17 Jun, 08:25 UTC. SecurityOnline. AdGuard blocks Joomla exploit and launches email tracking shield. Cites a CVE in CISA KEV.
- Wed 17 Jun, 15:40 UTC. Security Affairs, its first report on the story. CISA flags critical Joomla JCE bug enabling remote code execution. Cites a CVE in CISA KEV.
- First report
- Article
- Official notice
- Running total
Added to CISA KEV
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 16 Jun 20:50 | CISA | CISA adds critical Joomla editor flaw CVE-2026-48907 to KEV |
| 16 Jun 21:37 | CISA | CISA Adds CVE-2026-48907 Joomla Editor Flaw to Known Exploited List |
| 17 Jun 07:21 | SecurityOnline | WooCommerce stores hit by payment skimmer (CVE-2026-48907) |
| 17 Jun 07:50 | SecurityWeek | Joomla and LiteSpeed Bugs Let Attackers Run Code, Gain Root |
| 17 Jun 08:25 | SecurityOnline | AdGuard blocks Joomla exploit and launches email tracking shield |
| 17 Jun 15:40 | Security Affairs | CISA flags critical Joomla JCE bug enabling remote code execution |
- CISA Adds CVE-2026-48907 Joomla Editor Flaw to Known Exploited ListCISA · official notice
- CISA adds critical Joomla editor flaw CVE-2026-48907 to KEVCISA · official notice · first in our coverage
New articles also arrive in the RSS feed.