A content editor for Joomla!®
Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.
Latest post by Ryan on Saturday, 13 June 2026 10:19 BST
Hi,
since we've spent lots of time last week dealing with the hacks due to the JCE related issue, we've also done some analysis and this is a serious security problem:
Before update, the access rights were only for super users (OK), but now these plugins: JCE content plugin and System-JCE Pro has changed to public.
Can you possibly fix it ASAP?
AFTER:
BEFORE:
The ACYMailing plugin is not a core JCE Plugin.
All JCE Plugins are installed as standard using the Joomla Installer, and Access for the plugin is not changed on install or after.
Almost all Joomla plugins - including core system plugins - are set with Access = Public by default.
Ryan Demmer
Lead Developer / CEO / CTO
Just because you're not paranoid doesn't mean everybody isn't out to get you.
Please see the highlighted plugins that are JCE, I'm not talking about Acymailing.
What most people do does not have to be right... none of my websites allow using JCE from front-end (and we're talking about 200+ webs) so it makes no sense to give them access to JCE to upload anything they want...
well - the problem is that what you wrote is not accurate - just try to change it all to super admins and then update it. also disable system plugin as we do not need special features and then run the update. after the update the system plugin is re-enabled and some or all other plugins are switched from super admin to public.
Please try JCE Pro 2.9.99.7 Beta 4 - https://www.joomlacontenteditor.net/downloads/editor/pro/development/jce-pro-2-9-99-7-dev
To test this, I set all the JCE plugins to have Access level of Super User, on an existing installation.
Installed JCE Pro 2.9.99.7 Beta 4. All the plugins remained with Access Level = Super User.
Ryan Demmer
Lead Developer / CEO / CTO
Just because you're not paranoid doesn't mean everybody isn't out to get you.
Hi Ryan,
I just installed it at Joomla 3 and everything is public now"
I'm not seeing this in my tests. If the Access was set to Super User, and then JCE Pro 2.9.99.7 is installed, the Access remains Super User.
Ryan Demmer
Lead Developer / CEO / CTO
Just because you're not paranoid doesn't mean everybody isn't out to get you.
maybe stupid question, but is there a quick way to change access rights on all the plugins to super user when I see them as public... maybe it was done by the intruders, but if you last build keeps the original access rights, then it does not help fix the problem... can your build enforce super user on all?
Joomla does not appear to have a way to apply Access levels to a selection of plugins.
This is not something I can do in the install routine either because it is not the default. The Joomla Installer handles the installation of the all the different plugins in the JCE Pro package, with the usual system defaults.
Ryan Demmer
Lead Developer / CEO / CTO
Just because you're not paranoid doesn't mean everybody isn't out to get you.