CVE entry · CVE-2026-48907
CVE-2026-48907: Widget Factory Joomla Content Editor Improper Access Control Vulnerability
Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users.
- Actively exploited: added to CISA’s KEV catalog on June 16, 2026.
- Use by ransomware: not established so far.
- Remediation deadline for US federal agencies: June 19, 2026.
Description from CISA’s KEV catalog.
What to do
- Check whether your estate includes Widget Factory Joomla Content Editor , including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.
References
- Vendor advisory or reference cited by CISA (www.joomlacontenteditor.net)
- Vendor advisory or reference cited by CISA (www.joomlacontenteditor.net)
- NVD entry (NIST)
- CISA KEV catalog