Google AI reports as follows:
The critical Joomla Content Editor (JCE) exploit (tracked as CVE-2026-48907) is not attributed to a single named hacker or group. Instead, it is actively being weaponized by unknown, automated threat actors and cybercriminal syndicates.
Because the security gap is highly severe with a CVSS score of 10.0 and public exploit code exists, threat actors are using automated scanners to hunt for unpatched sites.
How the Exploit Works
- The Flaw: The JCE plugin fails to enforce access controls during the profile import workflow.
- The Attack: Unauthenticated threat actors (meaning anyone with zero login credentials) can remotely create new editor profiles on your site.
- The Impact: This allows attackers to bypass security filters and upload arbitrary PHP files, giving them complete remote code execution (RCE) and full control of the web server.
How to Protect Your Site
- Update Immediately: The vulnerability impacts JCE versions 1.0.0 through 2.9.99.4. Update to JCE Pro version 2.9.99.5 (or higher), which patches the flaw.
- Check for Indicators of Compromise: Updating closes the entry point but does not clean a site that has already been compromised. Look for unauthorized users and rogue PHP files in your web-accessible directories.
- Monitor Official Alerts: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this to its to its Known Exploited Vulnerabilities (KEV) Catalog due to the extent of the attacks.
You can read more about the flaw in the technical breakdown by SonicWall.
Other stuff
What JCE have said is here: https://www.joomlacontenteditor.net/news/jce-security-update-and-a-free-patch-for-older-sites
What happened to me:
- Problem with upgrading to Joomla 6.1.2. "administrator/components/com_joomlaupdate/extract.php" was inacessible..
- This then morphed into a collapse of the sites css - what a mess.
- Upgraded to 6.1.2 Ok apparently BUT the menu and all links then went.
- On JCE found that four new editor profiles had been added. Removed all of those . . . but the problems persisted.
- Found the "tmp" directory was full of stuff on two more sites.
- The solution to that was to empty, and rename it to "temp" - not forgetting to update the path.
- Admin Tools was unable to find and fix any of these.
- On one site the daily malware and virus scan picked up four files in a "tmp" directory
- 929929.php, ...svg, ...phtm, ...pht
- Cause: "file.put.contents.php.base64.decode"
What you need to do:
- Always take a backup using Akeeba Backup.
- Download the backup to your local pc
- Always immediately restore from the backup and check all is Ok.
- To recover I did the following:
- Deleted the site's database. Created a new database.
- Deleted everything in the public_html directory.
- Used a good backup, and updated it to 6.1.2, and updated all extensions.
- Uploaded that and ran kickstart.php. All went well and two sites restored.
- Made a backup, downloaded and tested that.