Joomla sites are most often compromised through outdated extensions and old core. An attacker injects PHP files onto the server through a known vulnerability, and the site then sends spam, redirects visitors, or displays defaced content. One vector has been keeping statistics for years.
A classic that still rages today: JCE editor (com_jce)
The popular JCE editor (the com_jce component) has been a target for years. An old plugin.rpc flaw allowed arbitrary file uploads, and in 2026 a new critical vulnerability was discovered. Typical clue: new .php files in images/ or media/ . For more details, see the JCE vulnerability (CVE-2026-48907) article .
Signs of a hacked Joomla
- Planted content or foreign messages on the cover (defacement)
- Redirecting visitors to unknown pages
- Unknown
.phpfiles inimages/,media/,tmp/or root - Unknown Super User accounts in administration
- Google warning (Safe Browsing) or hosting block
The most common attack vectors
- A vulnerable plug-in that allows uploading (JCE and similar) — the most common entry point
- Outdated Joomla core with known vulnerabilities (SQLi, LFI)
- Weak administrator passwords without login protection
Emergency steps (if you know how)
- Make a copy (for forensics) and temporarily disable the page.
- Change all passwords — Joomla admin, hosting, FTP, database.
- Find the planted files — suspicious
.phpinimages//media/. - Close the entrance — update/remove the vulnerable plugin, update the core, and block PHP execution in
images/andmedia/. - Protect your login and turn on the security layer (WAF + scanner).
Key: cleaning without closing the vector almost always ends in reinfection. In the real case we show cleaning + locking media/ .
Send us the link — the diagnosis is free, and we'll get back to you within 5 minutes. Urgent repair →
WMD — Super fast support.
