CISA Warns of a Critically Exploited Joomla JCE Vulnerability

CISA added a Widget Factory Joomla Content Editor (JCE) vulnerability to its Known Exploited Vulnerabilities catalog. The flaw allows unauthenticated users to create new editor profiles and upload and execute PHP code. It is being actively exploited, working exploit code is public, and attacks are automated.