ctrlINT What the industry said about every indicator, with the quote

CVE-2026-48907Vulnerability

Widget Factory Joomla Content Editor Improper Access Control Vulnerability

Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .

Reported by 2 independent sources · first reported by Recorded Future · last reported

Last reported 1 month ago

CISA KEVAdded 16 Jun 2026
Fix due 19 Jun 2026
Used by ransomware: not knownCISA KEV catalogue
EPSS16.2%
higher than 96% of CVEsFIRST EPSS, as of 23 Oct 2026

What the reports say

3 reports, newest first · the exact sentence from each

  1. “…tation chains: react2shell (CVE-2025-55182), wp2shell (CVE-2026-63030 and CVE-2026-60137), xss2shell (CVE-2026-64638), joomla2shell (CVE-2026-48907), and deep.”

    Datadog Security LabsVendor
    Attacker infrastructure, but vibe-coded: tracking the evolution of credential harvesting platforms

  2. “CVE-2026-48907”

    Recorded FutureVendor
    July 2026 CVE Landscape

  3. “CVE-2026-48907”

    Recorded FutureVendor
    June 2026 CVE Landscape

Indicators reported together

named in the same reports

Also named with it: CVE-2025-55182, CVE-2026-25089, CVE-2026-39808, CVE-2021-27137, CVE-2026-46817, CVE-2026-60137, CVE-2026-63030, CVE-2026-12569, CVE-2025-49113, CVE-2026-33824, CVE-2024-42009, CVE-2026-15409, CVE-2026-15410, CVE-2026-11645, CVE-2026-42897, CVE-2026-28318, CVE-2026-20230, CVE-2026-35616, CVE-2026-33825, CVE-2026-21509

Thanks — we review every report.

Report a wrong value
What is wrong with CVE-2026-48907 here?
No account needed. We do not store your IP address.