Actively exploited vulnerabilities affecting Widget Factory products.https://wildfortech.comhttps://wildfortech.com/security#CVE-2026-48907https://wildfortech.com/security#CVE-2026-48907This vulnerability in the Joomla Content Editor (JCE) plugin allows unauthenticated users — meaning anyone, no login required — to create new editor profiles and exploit them to upload and execute arbitrary PHP code on the server. Remote code execution by an unauthenticated attacker represents a critical risk: a successful exploit gives an attacker direct control over the web server, enabling data theft, defacement, backdoor installation, or use as a launchpad for further attacks.Tue, 16 Jun 2026 00:00:00 GMTWidget FactoryJoomla Content Editor