The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a directive for federal agencies to patch a maximum-severity vulnerability in the Widget Factory Joomla Content Editor (JCE) plugin. The flaw is being actively exploited in the wild, according to the agency's notice.
CISA's order mandates that all affected federal civilian executive branch agencies apply patches by Friday, reflecting the elevated risk posed by the bug. The severity rating assigned to the vulnerability is the highest possible, though a specific CVSS score was not detailed in available sources.
Although technical specifics of the exploitation mechanism are sparse, CISA's inclusion of the flaw in its Known Exploited Vulnerabilities catalog confirms that attackers are actively leveraging it. The JCE plugin is widely used for content management on Joomla sites, making the bug a significant supply-chain concern.
No patches or workarounds beyond the generic directive have been publicly outlined by either CISA or Widget Factory as of the latest reports. Users of the JCE plugin on non-federal systems are strongly advised to prioritize updates or disable the plugin until a fix is confirmed.
Attribution for the exploitation remains unknown at this time. The incident underscores the persistent threat landscape targeting open-source content management ecosystems, where plugin vulnerabilities often serve as entry points for broader network compromise.