Two content-management plugin vulnerabilities — one in a Joomla rich-text editor extension, one in a Magento cache-warming module — both reached a maximum-severity 9.8 CVSS score and both let a completely unauthenticated attacker achieve remote code execution, despite living in entirely different ecosystems built by entirely different vendors.
| CVE | CVSS | Product | Added to KEV |
|---|---|---|---|
| CVE-2026-48907 | 9.8 | Widget Factory Joomla Content Editor (JCE) | 16 Jun 2026 |
| CVE-2026-45247 | 9.8 | Mirasvit Full Page Cache Warmer for Magento 2 | 3 Jun 2026 |
Two unauthenticated paths to the same destination: arbitrary code execution
CVE-2026-48907 affects JCE, one of the most widely installed rich-text editor replacements in the Joomla ecosystem. NVD's description is unusually direct about the mechanism: "a vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution." Editor profiles in JCE control what a given user role is permitted to do inside the editor — including, in a compromised configuration, what file types can be uploaded through it. Allowing an unauthenticated visitor to create a new profile means they can grant themselves whatever upload permissions the profile system supports, and from there, upload a PHP file directly onto the web server. The vulnerability class here is improper access control (CWE-284) — not a memory-safety bug, not an injection flaw, but a straightforward failure to require authentication for an administrative action.
CVE-2026-45247 takes a different technical path to an identical outcome. Mirasvit's Full Page Cache Warmer for Magento 2, per NVD, "contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie." The description continues: "attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server." This is a textbook PHP deserialization attack (CWE-502) — the module trusted attacker-controlled cookie data enough to run it through unserialize(), and Magento's own dependency tree happened to contain the gadget classes needed to turn that into code execution. Where JCE's flaw is a missing permission check, Mirasvit's is a missing input-trust boundary around a dangerous native function — different root causes, same 9.8 severity, same unauthenticated-to-RCE outcome.
Why third-party CMS plugins are a structurally different risk than core platform code
Both of these products are extensions bolted onto a much larger, more heavily scrutinized core platform — Joomla and Magento, respectively. That distinction matters more than it might seem: core CMS platforms with large install bases tend to receive disproportionate security research attention, bug bounty coverage, and hardened development practices, simply because so many eyes are on them. The plugin and extension ecosystems surrounding those platforms don't automatically inherit that scrutiny. A third-party editor extension or a niche performance-optimization module is maintained by a much smaller team, tested by a much smaller pool of researchers, and — critically — still runs with the same server-level privileges as the core platform once installed. An unauthenticated RCE in either of these products doesn't just compromise "the plugin"; it compromises the entire Joomla or Magento installation and whatever else runs alongside it on that server.
What to check this week
Patch JCE and Mirasvit Full Page Cache Warmer immediately if either is installed, treating both with the urgency their 9.8 scores and unauthenticated-RCE mechanisms warrant — there is no meaningful mitigating factor in either advisory (no required authentication, no unusual configuration prerequisite).
Audit the full extension/plugin inventory on every Joomla and Magento installation, not just the two named here — both incidents are reminders that third-party extensions deserve the same patch-tracking discipline as the core platform, and often don't receive it.
Check for signs of unauthorized editor profiles (Joomla/JCE) or unexpected server-side files (Magento/Mirasvit) as indicators of prior compromise, since both vulnerabilities have been confirmed exploited and a patch alone won't remove an already-planted webshell.
Review cookie-handling code in any custom or third-party Magento modules for calls to unserialize() on attacker-influenced input — the specific pattern behind CVE-2026-45247 is a well-known PHP anti-pattern that may recur in other modules beyond this one.
A closing note on why "just a caching plugin" is a misleading frame
A full-page cache warmer sounds like the kind of low-stakes performance utility that wouldn't warrant deep security review — it doesn't touch payments, doesn't touch customer data directly, its whole job is to pre-fetch pages faster. That's exactly the reasoning that lets a vulnerability like CVE-2026-45247 go unnoticed: severity has nothing to do with a plugin's advertised purpose and everything to do with what code paths it exposes to untrusted input, in this case a cookie value fed straight into unserialize().
A final consideration on editor and profile-based access models
Any CMS extension that implements its own internal permission or profile system — as JCE does with editor profiles — deserves scrutiny of whether that system can be manipulated by an unauthenticated caller, independent of whatever access controls the surrounding CMS itself enforces.
How Safeguard helps
Safeguard's continuous inventory extends down to the plugin and extension layer of CMS platforms like Joomla and Magento, not just the core software version, because — as this cluster shows — the extension is frequently where the unauthenticated remote-code-execution risk actually lives.
