THREATOPS

THREAT OPS › CVEs › CVE-2026-48907

CVE-2026-48907 — Widget Factory Joomla Content Editor Improper Access Control Vulnerability

CISA KEVExploited: confirmedWidget Factory

Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users.

Vulnerability details

Affected productsJoomla Content Editor
KEV remediation due2026-06-19

Related reporting

How WP-SHELLSTORM Exposed 1.4M WordPress Sitessocradar_blog
[CISA KEV] CVE-2026-48907 — Widget Factory Joomla Content Editor : Widget Factory Joomla Content Editor Improper Access Control Vulnerabilitycisa_kev
June 2026 CVE Landscaperecordedfuture