Threat actors are targeting vulnerabilities in Joomla and the LiteSpeed cPanel plugin for code execution and privilege escalation. Affecting the Joomla Content Editor (JCE) for Joomla and tracked as CVE-2026-48907, the first bug is described as an improper access issue that allows unauthenticated attackers to upload editor profiles. Attackers have been exploiting the flaw to upload arbitrary files to the server, leading to arbitrary PHP code execution.
| Vendor | Product | Versions |
|---|---|---|
| joomlacontenteditor.net | joomla content editor (jce) extension for joomla | 1.0.0-2.9.99.4, 2.9.99.5 |
Updated description with technical details, changed severity to HIGH, added CVSS estimate of 7.5, specified affected version 2.9.99.5, provided patch version 2.9.99.6, and included IoCs and MITRE ATT&CK technique T1203.
Updated severity to CRITICAL and CVSS score to 10.0, and added new CWE-20.
Updated severity to CRITICAL and marked the vulnerability as actively exploited.
Initial creation
