# Check for JCE Rogue Profiles & Backdoors 1. [Home](https://mysites.guru/) 2. [Tools](https://mysites.guru/tools/) 3. [Hacked site detection](https://mysites.guru/tools/hacked-site-detection/) 4. Check for JCE Rogue Profiles & Backdoors # Check for JCE Rogue Profiles & Backdoors ![Check for JCE Rogue Profiles & Backdoors](https://mysites.guru/_astro/jce-rogue-profiles.rLj_vl___Z2v0aRU.webp) A rogue JCE editor profile lets an attacker re-upload a webshell after every clean-up. How to spot the fake profile and the files it plants on a Joomla site. Article Contents - [What the JCE rogue profile check examines](#what-the-jce-rogue-profile-check-examines) - [How an anonymous upload becomes a working webshell](#how-an-anonymous-upload-becomes-a-working-webshell) - [Every profile traceable to someone on your team](#every-profile-traceable-to-someone-on-your-team) - [Removing rogue JCE profiles and backdoors](#removing-rogue-jce-profiles-and-backdoors) - [Watching JCE profiles twice a day](#watching-jce-profiles-twice-a-day) - [Further Reading](#further-reading) - [Frequently Asked Questions](#faq) ## What the JCE rogue profile check examines JCE (`com_jce`) is installed as the content editor on more Joomla sites than any other, which makes it a standing target, and [finding every site running a vulnerable version](https://mysites.guru/blog/finding-every-site-running-a-vulnerable-jce/) is how this check started. This check reads the JCE profiles table (`#__wf_profiles`) for editor profiles with the attacker’s signature: a machine-generated name matching `J` followed by six digits (`J938560`, `J991471`, `J940401`), a label such as `Pwned` with a description of `RCE via JCE`, a large negative ordering value that forces the profile to the top of the list, or upload filetypes that include `php`, `phtml` or `txt`. It also checks the known JCE drop locations, `tmp`, `images`, `media/system/js` and `libraries/joomla`, for the malicious profile-import file the attack uploads, and for dropped webshells matching known signatures: hidden files named like `.xml.php`, so they read as a harmless config file at a glance; `eval(gzinflate(base64_decode(...)))` droppers, which decompress and run a payload that never touches disk in readable form; `filter_input(INPUT_POST, ...)` and `shell_exec($_GET/$_POST)` backdoors, which take a command straight out of the request and run it; and `Nxploited` marker files, a calling-card left by the specific toolkit behind this campaign. A profile that simply has `allow_php` enabled is **not** flagged. That setting controls whether PHP code survives inside article content, not whether files can be uploaded, and legitimate developer-built profiles often have it switched on. The signal this check acts on is a profile that permits uploading a script extension through the file browser, whatever its `allow_php` setting says. ## How an anonymous upload becomes a working webshell The vulnerability behind this attack is an unauthenticated editor-profile upload: insufficient access controls let an anonymous visitor, with no Joomla account at all, upload an editor profile. Because a profile defines exactly what filesystem and upload actions JCE permits, the compromise runs in a short, predictable chain. First, a request to JCE’s profile-import function, with no valid Joomla session, is accepted and saved as a new row in `#__wf_profiles`. That new profile has an upload filetype allowlist the attacker controls, one that includes `php` or `phtml` where a legitimate profile never would. Next, the same visitor opens JCE’s own file browser, now permitted by the fake profile’s ID, and uploads a PHP file the site would ordinarily reject. That file is the webshell, and from there the attacker can read, write and run anything the web server’s user account can reach, including planting further backdoors, creating rogue admin accounts, or reaching other sites on the same hosting account. It affects every Joomla site running a vulnerable JCE version, not just sites that allow public registration, because the whole point of the flaw is that no account is needed at any step. Finding a rogue profile means assuming compromise, not cataloguing it The profile row is a symptom, not the whole event. The upload it enabled is what actually did the damage, so treat a flagged site as breached and work through the full clean-up below rather than deleting the profile and moving on. The entry point, an out-of-date JCE install, is usually still open until you patch it. Telling a malicious profile from a only permissive one is the point of getting this right: Legitimate profile Rogue profile Name Descriptive (Default, Lightweight) `J` + six digits (`J938560`) or `Pwned` Ordering Normal, positive value Large negative, forced to the top (e.g. `-99999`) Upload filetypes Images and documents only Includes `php`, `txt` or `phtml` `allow_php` in content May be on for legitimate reasons Irrelevant to the attack Judge a profile by what it lets you upload, and by whether anyone on your team actually created it. `allow_php` is a red herring either way. ## Every profile traceable to someone on your team Every editor profile on the site was created on purpose, by someone you can name, with an upload filetype list limited to images and documents. Nothing in `#__wf_profiles` has the machine-generated naming pattern, a forced top-of-list ordering, or an upload allowlist that includes a script extension. ## Removing rogue JCE profiles and backdoors 1. **Preserve evidence first.** List every profile in `#__wf_profiles` and note anything you plan to remove before you remove it, in case you need it later. 2. **Delete the rogue profile.** Remove the matching row from `#__wf_profiles` through phpMyAdmin or your database tool, and delete any dropped webshells you found in `tmp`, `images`, `media/system/js` or `libraries/joomla`. 3. **Update JCE to the current version.** The upload flaw was fixed in 2.9.99.5, with further hardening since, so update straight to whatever JCE currently ships rather than stopping at the first patched release. Until it is updated, the site can be re-breached within hours. 4. **Rotate secrets.** Change the Joomla administrator password, any FTP or SSH credentials, and the Joomla secret in `configuration.php`, since a webshell running as the web user could have read all of them. 5. **Check the rest of your sites.** This is automated, sprayed tooling. When one site running JCE is hit, others running the same vulnerable version usually are too. ## Watching JCE profiles twice a day On every snapshot, twice a day, mySites.guru reads the JCE profiles table and the known drop locations against the signatures above, and flags any site with a rogue profile or a matching webshell. We show you exactly which row and which file triggered the flag, so you can verify it before you touch anything. ## [Check for JCE Rogue Profiles & Backdoors](https://mysites.guru/free-audit/?check=joomla/hacked/jcerogueprofiles) mySites.guru checks every connected site for this automatically and flags it the moment it appears. These run twice a day on every connected site. [Check your site for free](https://mysites.guru/free-audit/?check=joomla/hacked/jcerogueprofiles) ## Further Reading - [How to Fix Your Hacked Joomla Site After the JCE Profiles Vulnerability](https://mysites.guru/blog/finding-every-site-running-a-vulnerable-jce/) - [JCE Free/Pro 2.9.99.5 Patches the Unauthenticated File Upload (CVE-2026-48907)](https://mysites.guru/blog/jce-pro-2-9-99-5-security-update/) - [JCE Pro 2.9.99.6 Hardening Release](https://mysites.guru/blog/jce-pro-2-9-99-6-security-update/) JCE has shipped multiple security and hardening releases since the June 2026 fix. Always update to the current version, not just the one that closed this specific hole. ## Frequently Asked Questions Show all What is the JCE rogue profile hack? It exploits an unauthenticated editor-profile upload in the JCE editor for Joomla ([CVE-2026-48907](https://mysites.guru/vulnerabilities/CVE-2026-48907/)). An anonymous visitor with no account imports an editor profile that re-enables PHP file uploads, then uses that profile to upload a webshell through the JCE file browser. Does having allow\_php switched on mean my JCE profile is compromised? No. allow\_php controls whether PHP code survives inside article content, not whether files can be uploaded, and legitimate developer-built profiles often have it on for good reason. The signal to act on is a profile whose upload filetypes include a script extension such as php, phtml or txt, not the allow\_php setting. Which JCE versions are affected? Every version of JCE Free and JCE Pro before 2.9.99.5 is vulnerable, including the whole 2.9.99.x branch and every older release. The developer patched the upload flaw in 2.9.99.5, then ran a four-day audit and shipped a hardening release in 2.9.99.6, and has continued to ship further security releases since. Always update to the current version rather than stopping at the first fix. [![EU icon: AI MODIFIED](https://mysites.guru/_astro/ai-modified.CaoawZEQ_1In0VX.webp)Written and edited by a human, with AI assistance. Our approach to AI](https://mysites.guru/ai-statement/) ### Article Contents - [What the JCE rogue profile check examines](#what-the-jce-rogue-profile-check-examines) - [How an anonymous upload becomes a working webshell](#how-an-anonymous-upload-becomes-a-working-webshell) - [Every profile traceable to someone on your team](#every-profile-traceable-to-someone-on-your-team) - [Removing rogue JCE profiles and backdoors](#removing-rogue-jce-profiles-and-backdoors) - [Watching JCE profiles twice a day](#watching-jce-profiles-twice-a-day) - [Further Reading](#further-reading) - [Frequently Asked Questions](#faq) - **Published** - 28 August 2026 - **Applies to** - Joomla - **One-click fix** - Manual fix Share [](https://x.com/intent/post?url=https%3A%2F%2Fmysites.guru%2Ftools%2Fhacked-site-detection%2Fjce-rogue-profiles%2F&text=Check%20for%20JCE%20Rogue%20Profiles%20%26%20Backdoors)[](https://bsky.app/intent/compose?text=Check%20for%20JCE%20Rogue%20Profiles%20%26%20Backdoors%20https%3A%2F%2Fmysites.guru%2Ftools%2Fhacked-site-detection%2Fjce-rogue-profiles%2F)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fmysites.guru%2Ftools%2Fhacked-site-detection%2Fjce-rogue-profiles%2F) Topics [Hacked site detection](https://mysites.guru/tools/hacked-site-detection/)Joomla [ ★★★★★ > "I'm not a professional web developer, but know enough to manage my website. For peace of mind, using this service has proved so well worth it! Phil has taken the time to answer what would probably be some very basic questions to the professionals. The site snapshot and audit have proved invaluable in best practice and site safety. I can highly recommend!" ![Rosemarie](https://mysites.guru/images/reviews/rosemarie.webp) Rosemarie ](https://mysites.guru/reviews/) ## More checks in [Hacked site detection](https://mysites.guru/tools/hacked-site-detection/) - [ ### Helix Ultimate Mega Menu Hack A Helix Ultimate Joomla extension mega-menu setting can carry a stored XSS payload that never touches a file, so scanners miss it. How to check and clean it. ](https://mysites.guru/tools/hacked-site-detection/helix-ultimate-mega-menu-hack/) - [ ### Helix3 Custom Code Hack The Helix3 Joomla extension Custom Code template fields can carry a database-only defacement payload that file scanners never see. How to check and clean it. ](https://mysites.guru/tools/hacked-site-detection/helix3-custom-code-hack/) - [ ### Impostor Plugin Identities One malware family invents a plugin, an author and a vendor domain per site it breaks into, and the three agree in a way a real vendor identity rarely does. ](https://mysites.guru/tools/hacked-site-detection/impostor-plugin-identities/) - [ ### Check For Malicious Cron Jobs A cron job that quietly re-downloads malware after every clean-up is why a hacked Joomla site keeps reinfecting itself. How to find one and remove it safely. ](https://mysites.guru/tools/hacked-site-detection/malicious-cron-jobs/) - [ ### Check For Malicious Scheduled Tasks Joomla has run a scheduler of its own since 4.1, in a database table that no crontab lists and no file scanner reads. How a planted task is found and removed. ](https://mysites.guru/tools/hacked-site-detection/malicious-joomla-scheduled-tasks/) - [ ### Check For Malicious WP-Cron Events WordPress runs its own scheduler out of one database row, where no server crontab and no file scanner can see it. How a planted event is found and removed. ](https://mysites.guru/tools/hacked-site-detection/malicious-wp-cron-events/) ## See where your own sites stand One free audit of one site · no card · about 2 minutes to connect [Get Your Free Site Audit](https://manage.mysites.guru/en/register) [What the JCE rogue profile check examines](#what-the-jce-rogue-profile-check-examines) [How an anonymous upload becomes a working webshell](#how-an-anonymous-upload-becomes-a-working-webshell) [Every profile traceable to someone on your team](#every-profile-traceable-to-someone-on-your-team) [Removing rogue JCE profiles and backdoors](#removing-rogue-jce-profiles-and-backdoors) [Watching JCE profiles twice a day](#watching-jce-profiles-twice-a-day) [Further Reading](#further-reading) [Frequently Asked Questions](#faq)