According to mySites.guru

An unauthenticated flaw in Joomla's most-installed editor lets attackers import a rogue editor profile and drop a webshell on any site running JCE below 2.9.99.6. No login, fully automated, and the exploit is now public. mySites.guru finds it, and fixes it, across every Joomla site you manage.

JCE is the work of an independent developer who patched this fast. Support that work and buy JCE Pro.

CVE-2026-48907: unauthenticated file upload

Hardening release after a full audit

Working exploit code published on GitHub

Added to CISA's exploited-vulnerabilities catalog

JCE's editor profiles decide which filetypes a user can upload and into which directories. That is normally a good thing: different user groups get different editor capabilities. The flaw, CVE-2026-48907 , let an unauthenticated visitor import their own profile.

The attack chain is short. Import a rogue profile that re-enables php and txt uploads with MIME validation switched off, then use that profile to upload a webshell. The result is a persistent backdoor on the server, with no login required at any step.

We did not find this in a lab. We found it on live Joomla sites: a rogue profile built to allow file uploads, and a set of webshells dropped through it, still sitting on disk. It started with three sites in one portfolio. We have since seen hundreds, and with working exploit code published on GitHub on 9 June 2026, we expect thousands over the coming days. This is automated tooling spraying the same exploit at every JCE install it can reach, so a site with no public registration is not safe .

The JCE developer has since confirmed the same thing publicly : the vulnerability is being actively exploited, working exploit code is public, and the attacks are automated, so a site with no public registration is not safe. The developer's reliable confirmation tell is in your web server access logs, where unauthenticated requests to index.php?option=com_jce&task=profiles.import mark when the site was first reached. That advisory links to this page for the full technical breakdown.

On 16 June 2026, the US government's cyber agency, CISA, added CVE-2026-48907 to its Known Exploited Vulnerabilities catalog , listed as the "Widget Factory Joomla Content Editor Improper Access Control Vulnerability". CISA only adds a flaw to that catalog when it has evidence of active exploitation in the wild , so this is independent, government-grade confirmation of what we and the developer were already seeing. The catalog comes with a remediation deadline for US federal agencies, and while that directive binds only those agencies, CISA urges every organisation to treat a KEV-listed flaw as a patch-now priority. If a government agency is being told to drop everything and patch this, the older Joomla sites in your portfolio are not the exception.

This is a Joomla-only issue. JCE has no WordPress build, so WordPress sites are unaffected.

Basic Joomla Tutorials walks through spotting the JCE Profiles hack and cleaning it up with mySites.guru.

The attack leaves the same fingerprint every time. Check three places: your editor profiles, the files on disk, and your access logs.

Machine-generated names like J940401 or J938560, or blunt labels like "Pwned" with a description of "RCE via JCE". They are imported, so there is no matching admin action in your logs.

A large negative ordering value, often -99999, pins the rogue profile above your real ones so it takes effect. Legitimate profiles use normal positive ordering.

The rogue profile lists php, phtml or txt in its upload filetypes with MIME validation switched off. That is the part that lets an attacker drop a webshell. allow_php on its own is not the signal.

Unexpected PHP in tmp, media, images or the libraries tree. Look for hidden .xml.php droppers, eval(gzinflate(base64_decode(...))) blobs, shell_exec command shells, and small "Nxploited" marker files.

A POST to task=profiles.import that creates the rogue profile, followed immediately by a POST to method=upload that drops the shell. Both return 200, both unauthenticated, often carrying an id=RCExxx marker.

This is a botnet spraying the same exploit at every JCE install it can reach. A site with no public registration is not safe, because the flaw needs no login at all.

Hunting for this by hand, one administrator panel at a time across 40 client sites, is the kind of job that never actually gets done. So we built a check that does it for you, on every connected Joomla site, on every snapshot, twice a day.

The dedicated JCE check above is new. The detection underneath it is not. Every mySites.guru audit has always read every file in your webspace, line by line, including the dormant files a browser-based scanner never sees. The webshells this attack drops, the hidden .xml.php droppers, the obfuscated eval(gzinflate(base64_decode(...))) blobs, the shell_exec command shells, were already being flagged by the suspect content and hacked file scanning that runs on every snapshot: over 2,000 hand-written patterns and 14,000+ confirmed-hacked file hashes, updated daily. Even the fake JCE profile itself stood out, because of tells like the forced -99999 ordering no real profile ever uses.

What we built this week is a whole set of new tooling aimed squarely at this attack. A dedicated check that targets the specific known droppers and files from the JCE hack and reports them in their own "Hacked?" section, a one-click tool that removes a fake profile straight from the JCE profiles database, and the detection signatures behind both, all added in days. It is the difference between "your audit flagged some suspect files, go and read them" and "this is the JCE profiles attack, here is exactly what to remove, remove it now." If you want the detail on the two underlying signals and how to tell a real threat from a noisy one, the suspect content vs hacked files guide walks through it.

That is the pattern, not the exception. mySites.guru is, has been, and always will be updated daily with new features, tools, recipes and detection to match what agencies running Joomla, and WordPress, actually need as the threats move. When the attack lands, the underlying scanning has usually already seen the shape of it, and a targeted tool follows close behind.

Cleaning up after a hit is only half the job. The other half is making sure none of your other sites are . The extension lists every site with JCE installed, grouped by version, so you can find anything still on a vulnerable build in seconds, then push the patch across every affected site with the mass updater instead of logging into each panel by hand.

Recommended target for every site. Hardening audit on top of every prior fix.

Closes CVE-2026-48907. Update again to 2.9.99.6.

Carries the unauthenticated profile upload. Public exploit exists. Update, or apply the free patch if you cannot.

Carries the flaw and years of unpatched issues. The developer's free patch package covers these for sites that cannot update.

Not affected in a default config: the profile import path is blocked. Still unsupported, so plan to migrate.

A wave of quick "JCE hack fixer" scripts has appeared, most of them clearly written by AI in an afternoon. They look reassuring. They are not enough.

Most of these tools do one thing: delete the rogue editor profile and remove a handful of dropper files that have been seen in a few well-known locations. That addresses the very basics, and nothing more. They do not take into account the security of the whole site, and they ignore the most important fact this attack: once a hacker has uploaded dropper files, they have already had the run of your server.

A dropper is not the end of the attack, it is the beginning. With those files in place, an attacker can do all kinds of damage and manipulation: add extra super administrators so they keep access after you patch, upload even more files in directories no quick script thinks to check, modify legitimate files to reinfect on a schedule, or download your entire database , customer data and all. A tool that removes one known profile and three known files leaves every one of those open.

The only thing that actually clears a site is a tool that monitors continuously and brings a full suite of checks to bear, taking a comprehensive, whole-site look at the install and how well it holds to best practice: every file read line by line, rogue administrators surfaced, suspect content flagged, extensions checked for known vulnerabilities, and the entry point patched so it cannot happen again. For Joomla, the only tool that does all of that in one place is mySites.guru .

JCE 2.9.99.6 needs PHP 7.4 and Joomla 3.10 or later. For sites that genuinely cannot meet that yet, the JCE developer has released a free patch package that closes this vulnerability in JCE 2.7.x, 2.8.x and 2.9.x. JCE 2.6.x is not affected in a default configuration, but is unsupported and should still be migrated.

The patch is a stopgap, not a substitute for updating. It closes the vulnerability only, without the broader 2.9.99.6 hardening, and it does not clean a site that was already compromised. Back up and test on a copy first, and plan to move to a supported Joomla and PHP version. Updating remains the right answer wherever it is possible.

Register for free and install the mySites.guru connector extension. It takes two minutes per site, with no configuration required.

On every snapshot, twice a day, the check hunts for rogue editor profiles and the webshells they drop, across your whole portfolio at once.

See every flagged profile and file, remove them, and update JCE to the patched version from the same screen. Then sweep the rest with the extension .

Free to start. No credit card required.

The single best thing you can do for JCE's security is pay for it. A JCE Pro subscription is €39 a year, renewals from €29, and it directly funds the work that closed this vulnerability so quickly. When the attack surfaced, the developer shipped 2.9.99.5, then a full hardening release in 2.9.99.6, and a free patch for older sites, all in a matter of days. That responsiveness is exactly what a paid subscription keeps running.

Pro is also a better editor for the sites you build. You get the media manager, an AI assistant, layout columns, advanced paste cleanup, custom styles, microdata for SEO, and a monitored support forum, on top of the priority security updates. If JCE is part of your Joomla stack, this is the kind of small-developer tool that is well worth paying for.

For the source of truth on every JCE security update, read the developer's official news page , including the advisory on this vulnerability and the free patch . Straight from the developer, not filtered through third parties.

From €39/year · renewals from €29 · monitored support forum

JCE is not a mySites.guru product. JCE Pro is bought from, and supported by, the JCE developer, separately from and in parallel to any mySites.guru subscription.

If you are tempted to assume this only happens to neglected sites run by people who never patch, look at what it did to the most prominent Joomla properties there are. The hack did not stop at one site. extensions.joomla.org , the official Joomla Extensions Directory that every Joomla administrator visits to find and install extensions, was taken down and replaced with a bare 503 Maintenance holding page. So were community.joomla.org and certification.joomla.org , all serving the same maintenance page at the same time.

Sit with that for a second. These are not hobbyists' abandoned brochure sites. They are flagship properties run by the Joomla project itself, maintained by people who know Joomla security better than almost anyone, on infrastructure that is watched closely. JCE is one of the most-installed editors in the Joomla world, so any site running it was as exposed to this attack as a site could be, and exposure plus an unauthenticated, fully automated exploit is all it takes.

The botnet spraying this exploit does not check who owns a site or how competent its administrators are before it fires. It finds a reachable JCE install, imports the rogue profile, drops the shell, and moves on. A 503 maintenance page is what the cleanup looks like from the outside. "My sites are well looked after" and "I would have noticed" are not the protection they feel like, because this needs no login, leaves no failed-login trail, and lands on every reachable install at once.

If the Joomla project's own extensions directory, community site, and certification site can all be taken offline by it at once, the handful of older Joomla sites sitting quietly in your portfolio absolutely can be too. The only thing that actually protects a site is the JCE version it is running, and the only way to know that across a whole portfolio, without logging into every administrator panel by hand, is to have something watching all of them for you.

Treat the site as compromised and work through these in order. Patch the entry point, or it just reinfects.

Take a copy of the suspect profile and any suspect files first, as evidence, before you remove anything.

Delete the rogue editor profile and every webshell it dropped.

Update JCE to 2.9.99.6 so the entry point is closed. Removing files without patching invites reinfection.

Rotate your Joomla secrets and passwords, and any reused credentials.

Run a full file-level malware scan to confirm nothing else was dropped.

Want it handled for you? fix.mysites.guru offers same-day remediation at a flat rate.

Comprehensive, innovative and a lifeline for anyone building and managing websites . The speed at which he acted with the JCE hack illustrates Phil's vigilance and speedy approach to developing security tools in real time.

Thank you so much for your fantastic tool. Without it, I would never have noticed the installation of the backdoor plugins so quickly, and the cleanup work is so much more efficient. Best regards. Doris

We manage around 100 Joomla projects and are very happy that mysites.guru takes so much work off our hands. This makes regular Joomla maintenance a profitable business for us.

How we found it live, the IoCs in detail, and the new mySites.guru check.

CVE-2026-48907 explained, and why it must be patched now.

What a four-day audit changed, and why you still need it.

The two earlier fixes that started the run of releases.

Free file-level scan for compromised Joomla sites

One dashboard for every Joomla site you run

Automatic alerts for vulnerable extensions and plugins

Deep file-level scanning for backdoors and malware

Run a full health and security audit, free

Free security scan for compromised WordPress sites

Connect your Joomla sites and let mySites.guru hunt for rogue profiles and backdoors twice a day, then clean and patch them from one screen. Free to start.