CVE-2026-90900
MediumCVSS 5.3Summary
The Joomla Easy Store extension (joomshaper.com) in versions 1.0.0-3.0.0 contains a Missing CSRF Token Verification vulnerability in the product review submission endpoint (index.php?option=com_easystore&task=product.addReview). The endpoint accepted submissions without verifying an anti-CSRF token (the check had been commented out in code). An attacker could trick a logged-in user into posting unauthorized reviews or submitting review spam via cross-site requests. Resolved by enforcing Session::checkToken('request') / Session::checkToken('post') in ProductController, injecting HTMLHelper::_('form.token') into the review form template, and appending the session token to the submission payload in review-form.js.
Risk Assessment
An attacker can exploit a logged-in user to post unauthorized reviews or spam, potentially leading to content and reputation manipulation of the store. This affects data integrity and user trust.
Recommendation
Update the Easy Store extension to a version later than 3.0.0 that contains the fix for this vulnerability. If updating is not possible, consider disabling the review feature or implementing additional CSRF protections.
Other vulnerabilities in Easy Store
See all- CVE-2026-90905High
Joomla Easy Store extension (versions 1.0.0-3.0.0) lacks CSRF and access control on site configuration update, allowing modification of Joomla mail settings without token verification or admin permissions.
- CVE-2026-90904High
The Easy Store extension for Joomla (versions 1.0.0-3.0.0) has a broken access control vulnerability (ACL bypass) in the allowEdit() method in ApiController.php. This method always returns true, bypassing component-level and asset-level ACL permission checks. Any authenticated backend user can edit any EasyStore record regardless of specific ACL grants. Resolved by replacing the hardcoded boolean with proper ACL authorization checks.
- CVE-2026-90903High
The Easy Store extension for Joomla (versions 1.0.0-3.0.0) lacks CSRF token verification on most administrator AJAX endpoints. Tokens are only checked in the products() action, while other endpoints (orders, coupons, media, customers, settings, tags, categories, reviews, collections) accept state-changing requests without anti-CSRF tokens. An attacker can trick a logged-in administrator into triggering unauthorized modifications. Resolved by implementing global CSRF verification in ApiController::execute() for all state-changing HTTP methods.
- CVE-2026-90902High
The Easy Store extension for Joomla (versions 1.0.0-3.0.0) has a SQL Injection vulnerability in the coupon bulk update task (couponBulkUpdate). Input IDs are directly concatenated into raw SQL IN (...) clauses without sanitization or parameterization. An authenticated administrator can manipulate the query through injected SQL syntax. Resolved by strictly casting all IDs to integers and using parameterized ->whereIn() queries.
- CVE-2026-90901High
The Easy Store extension for Joomla (versions 1.0.0-3.0.0) has a SQL Injection vulnerability in media image deletion. The checkout.searchGuestUser endpoint allows querying guest checkout records solely by supplying an email address. The server returns complete shipping details (full name, phone number, street address, city, postal code, country) from the #__easystore_guests table without authentication, session validation, or ownership checks. An unauthenticated attacker can iterate through email lists to enumerate guest customers and harvest sensitive PII. Resolved by removing the unauthenticated server-side guest lookup endpoint and migrating autofill to client-side localStorage with explicit user consent.
- CVE-2026-90899High
The Easy Store extension for Joomla (versions 1.0.0-3.0.0) has an unauthenticated PII exposure vulnerability via IDOR in guest checkout. The checkout.searchGuestUser endpoint allows querying guest checkout records solely by supplying an email address. The server returns complete shipping details (full name, phone number, street address, city, postal code, country) from the #__easystore_guests table without authentication, session validation, or ownership checks. An unauthenticated attacker can iterate through email lists to enumerate guest customers and harvest sensitive PII. Resolved by removing the unauthenticated server-side guest lookup endpoint and migrating autofill to client-side localStorage with explicit user consent.
- CVE-2026-65761Critical
The Easy Store extension for Joomla versions 1.0.0-2.0.1 contains an unauthenticated SQL injection via improper validation of order parameters, allowing full database read access including credentials and sessions.
- CVE-2026-65759High
The Easy Store extension (versions 1.0.0-2.0.1) for Joomla! allows unauthenticated attackers to forge payments and orders by processing client-side data. Attackers can manipulate payment and order states.
Original NVD description (English source)
Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The product review submission endpoint (index.php?option=com_easystore&task=product.addReview) accepted submissions without verifying an anti-CSRF token (the check had been commented out in code). An attacker could trick a logged-in user into posting unauthorized reviews or submitting review spam via cross-site requests. Resolved by enforcing Session::checkToken('request') / Session::checkToken('post') in ProductController, injecting HTMLHelper::_('form.token') into the review form template, and appending the session token to the submission payload in review-form.js.