CISA has added a critical security vulnerability (CVE-2026-48907) in the Joomla Content Editor (JCE) plugin to its Known Exploited Vulnerabilities catalog due to active exploitation in the wild. The flaw, which has a maximum CVSS severity score of 10.0, involves improper access control that enables attackers to execute arbitrary PHP code. Organizations using Joomla with the JCE plugin should prior
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a maximum-severity security flaw impacting Widget Factory Joomla Content Editor (JCE) to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-48907 (CVSS score: 10.0), is a case of improper access control that could facilitate arbitrary
Originally published at thehackernews.com
60-minute technical evaluation, no obligation. We'll map the ideas in this article to your environment.
