Summary
Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users.
- Vendor
- Widget Factory
- Product
- Joomla Content Editor
- Added to KEV
- Jun 16, 2026
- Remediation due
- Jun 19, 2026 (US federal deadline)
- Ransomware use
- Not known
- Weakness
- CWE-284
- EPSS
- 85.4% as of Nov 12
In the news
- No Asia-Pacific article names this CVE yet.
Linked
Actors named alongside it:
none
Incidents exploiting it:
- none recorded
References