The Joomla Content Editor (JCE) extension for Joomla contains an improper access control vulnerability (CWE-284) that permits unauthenticated attackers to create new editor profiles. This flaw enables attackers to upload and execute arbitrary PHP code, potentially leading to full system compromise. The vulnerability affects all versions from 1.0.0 up to 2.9.99.4. The CVSS 4.0 score of 10.0 reflects the critical nature of this issue, with no required privileges or user interaction and a network attack vector. As of the published date, no official patch or remediation level has been provided by the vendor, and no known exploits have been observed in the wild.

Successful exploitation allows unauthenticated attackers to upload and execute arbitrary PHP code on the affected Joomla site, leading to full compromise of the web server and potentially the underlying system. This can result in complete loss of confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the Joomla Content Editor extension, disable or remove the extension if not needed, and monitor for unusual activity. Avoid exposing the affected Joomla installation to untrusted networks if possible.