Traces of attacks on JCE, Helix and SP Page Builder on Joomla sites
The most popular Joomla extensions are also the most attacked. Updating closes the hole, but what the attacker left in the settings stays there.
Updating closes the hole. What the attacker left stays behind.
The documented attacks on these extensions leave precise traces: a JCE editor profile that allows PHP uploads, code in the template settings, a script in a mega menu item.
These are settings saved in the database. The file integrity check doesn't see them.
What we look for.
JCE
Editor profiles you didn't create, with names like J123456 or labels like "Pwned", and executable types allowed in uploads (CVE-2026-48907).
Helix3 and Helix Ultimate
Code in the Helix3 style's Custom Code (CVE-2026-49049) and scripts in Helix Ultimate mega menu settings (CVE-2026-57829).
SP Page Builder
Icon fonts uploaded without a Joomla user, or PHP files among the fonts (CVE-2026-48908).
Want to try it on a real site? The 30-day trial needs no credit card.
Start free trialFrequently asked questions
Do you use attack payloads for testing?
No. The checks read settings and files, and we tested them with inert data based on the documented incidents.
Goes well with
- Hidden Joomla Super Users, and the other accounts to checkAccounts written into the database, known attack signatures, Super Users without MFA.
- Joomla core file integrity checks, even without official checksumsChecksums computed from the official Full Package, for Joomla 3, 4, 5 and 6.
- Vulnerability checks for plugins, themes and extensionsInstalled versions matched against Wordfence Intelligence and the Joomla Security Centre.
- Joomla website monitoring for web agenciesA native Joomla agent, with the same features as the WordPress one.
Try it on your clients' sites.
Connect your first sites today and see what SitePing finds on them.
- Every Complete feature except backups
- Up to 10 sites
- No credit card needed to start
- At the end you choose a plan or move to Free, and nothing is charged
Already have an account? Log in. Prefer to look at one site first? Free read-only audit.