The short version: Over the past week, hackers have been actively exploiting a vulnerability in JCE Editor — one of the most popular content editors used on Joomla websites — to break into sites, quietly plant hidden user profiles, and upload malicious files. If your site uses JCE Editor and hasn’t been updated to version 2.9.99.6 or newer, you should check it today. mysites.guru can do that check for you for free, and clean it up with a couple of clicks if anything is found.
Read the full technical breakdown ↓
What’s going on
Last week, a security vulnerability was discovered in JCE Editor, a Joomla extension that runs on a very large number of Joomla websites. Once the vulnerability went public, attackers got to work — defacing pages, planting backdoors, and using affected sites to send out spam and phishing pages.
Before going any further, a word about the developer. Ryan, who builds JCE Editor, is one of the good guys. We’ve had him on the channel here. The fact that a vulnerability turned up in his code isn’t a knock on him — these days, with AI being used to comb through codebases at a speed no human reviewer could match, vulnerabilities that have been sitting quietly in respected software for years are surfacing all over the industry. Some very large, very well-resourced companies have had to take dramatic emergency steps over the same kind of thing in the past few weeks. Ryan handled this one quickly and well — he had patches out as fast as anyone could ask.
But — and this is the part that matters for you — a patched extension only protects a site if the site actually gets the patch. A Joomla site that nobody is keeping current is a sitting target. If you’re not updating your own site, somebody needs to be doing it for you.
How to tell if your site has been hit
This is the easy part. Head over to mysites.guru, add your site (the free tier is enough for the check), and look at the snapshot. If your version of JCE Editor is older than 2.9.99.6, you’ll see a flag at the top: “This site has one or more vulnerable plugins.”
Right under it, there’s a tool called “Hacked — check for JCE rogue profiles and backdoors.” Click Investigate, and it tells you in plain English whether your site has been touched.
On the site I walked through in the YouTube video — a real client site I’m cleaning up this week — the tool found twelve fake user profiles that had been quietly created in JCE, and fifteen malicious files that had been uploaded as a result. The oldest file was four days old. The newest was three hours old. The attack was still in progress.
What you do about it
If the tool finds something, the cleanup itself is a couple of clicks:
- Remove the fake JCE profiles — one button.
- Delete the malicious files it found — one button.
- Update JCE Editor to the current version (2.9.99.6 or later).
- Let mysites.guru finish its full audit so it can sweep for anything that landed in less-obvious places.
That’s it. On the site in the video, the whole cleanup took less time than it takes to make a coffee.
The wider point
We’re going to see more of this — not less — for the next while. AI is finding vulnerabilities in software that’s been trusted for years, and the gap between “vulnerability is publicly known” and “attackers are scanning every site on the internet for it” is now measured in hours, not weeks. The websites that come through this fine will be the ones that are getting updated routinely, by someone whose job is to pay attention.
If that’s not you, and you’d like it to be us, my email is
🎥 Watch the walkthrough on YouTube: https://youtu.be/FHA7jeY-DyU
The technical breakdown
The rest of this post is for fellow admins who want to know exactly what the attack looks like on the inside. If you came for the summary, you’re done — thanks for reading.
The vulnerability
The affected component is JCE Editor by Ryan Demmer. Anything prior to 2.9.99.6 is vulnerable. The current release closes the hole; patches were pushed promptly after public disclosure.
The attack chain has two stages:
- Stage 1 — rogue JCE profile creation. The attacker uses the vulnerability to create one or more new JCE Editor profiles on the target site. JCE profiles control which Joomla user groups can use which editor features — and critically, which user groups are allowed to upload files through the editor. By creating a profile that grants upload rights to a permissive user group, the attacker turns a Joomla user account they can reach (often
GuestorRegistered) into an upload-capable user. - Stage 2 — malicious file upload. With upload rights in hand, the attacker uses JCE’s file-manager endpoint to drop PHP backdoors, spam mailers, phishing pages, and assorted other payloads into writable directories under
/images/(and from there, wherever else permissions allow).
Once stage 2 lands, the site is no longer just vulnerable — it’s compromised. From that point on, the attacker can come back through the backdoor regardless of whether JCE itself gets patched.
Detection — what mysites.guru looks for
The “Hacked — check for JCE rogue profiles and backdoors” tool runs two passes:
- JCE profile audit — enumerates JCE profiles, compares against known-good baselines plus an evolving list of attack-pattern profile names. (Phil at mysites.guru has been adding new patterns as they show up — there was one added the morning I recorded the video.)
- Malicious-file scan — walks the writable directories an upload-capable profile would target (typically under
/images/and a few common alternates) and flags files whose names, mtimes, or contents match the active campaign’s signatures.
On the client site in the walkthrough, the first pass found 12 rogue profiles. The second pass found 15 malicious files, the oldest dated four days ago and the newest three hours ago — meaning the kit was still active at the moment of detection.
Remediation — order of operations
The mysites.guru interface offers two big Remove / Delete buttons that handle the bulk of the work. The order matters:
- Remove rogue JCE profiles first. This pulls the upload privileges out from under the attacker. Until this step is done, deleting the malicious files only buys minutes — the attacker can re-upload through the same profile.
- Delete the flagged malicious files. Now that the upload door is closed, sweep the payloads out.
- Update JCE Editor to 2.9.99.6+ (Joomla → Extensions → Manage → Update). This closes the original vulnerability so the same hole can’t be used to plant new profiles.
- Let the full audit finish. The two-button cleanup handles the standard-location finds. A determined attacker will sometimes drop secondary backdoors in less-common places — the Joomla template directory, a writable component folder, a stray third-party extension’s cache dir. mysites.guru’s full audit takes longer to run but is what catches those. Leave it going.
- Rotate any credentials the attacker might have reached — Super User passwords, FTP/SSH keys, any tokens stored in writable config. Belt and suspenders.
- Check the Joomla user table for any newly-created users with elevated group memberships, and
#__users.lastvisitDatefor any unexpected Super User logins.
Lessons filed away
- Profile-table attacks are sneaky because they don’t look malicious in isolation. A new row in
#__jce_profilesdoesn’t trip antivirus scanners, doesn’t show up in Joomla’s “recent extensions installed” view, and doesn’t change file mtimes anywhere obvious. They’re easy to miss in a manual audit. Pattern-aware tools win here. - An out-of-date editor is a remote upload server. Any extension that controls file uploads gets the same level of “patch the day the patch ships” attention you’d give to the Joomla core.
- The gap from disclosure to mass-scanning is hours. Sites that were patched within a day of disclosure mostly came through clean. Sites that weren’t are where this week’s cleanup queue came from.
- A managed maintenance plan exists for exactly this kind of week. Most of the affected client sites I cleaned up this week were ones that were between maintenance plans. The ones on active plans had JCE patched within hours of release.
← Back to the plain-English summary
Add comment