CVE-2026-90905
HighCVSS 7.2Summary
Joomla Easy Store extension (versions 1.0.0-3.0.0) lacks CSRF and access control on site configuration update, allowing modification of Joomla mail settings without token verification or admin permissions.
Risk Assessment
A malicious site can send forged requests from an admin's browser, changing the site's sender name and email address, potentially leading to phishing or loss of trust.
Recommendation
Update the Easy Store extension to a version that enforces CSRF tokens and admin permission checks.
Other vulnerabilities in Easy Store
See all- CVE-2026-90904High
The Easy Store extension for Joomla (versions 1.0.0-3.0.0) has a broken access control vulnerability (ACL bypass) in the allowEdit() method in ApiController.php. This method always returns true, bypassing component-level and asset-level ACL permission checks. Any authenticated backend user can edit any EasyStore record regardless of specific ACL grants. Resolved by replacing the hardcoded boolean with proper ACL authorization checks.
- CVE-2026-90903High
The Easy Store extension for Joomla (versions 1.0.0-3.0.0) lacks CSRF token verification on most administrator AJAX endpoints. Tokens are only checked in the products() action, while other endpoints (orders, coupons, media, customers, settings, tags, categories, reviews, collections) accept state-changing requests without anti-CSRF tokens. An attacker can trick a logged-in administrator into triggering unauthorized modifications. Resolved by implementing global CSRF verification in ApiController::execute() for all state-changing HTTP methods.
- CVE-2026-90902High
The Easy Store extension for Joomla (versions 1.0.0-3.0.0) has a SQL Injection vulnerability in the coupon bulk update task (couponBulkUpdate). Input IDs are directly concatenated into raw SQL IN (...) clauses without sanitization or parameterization. An authenticated administrator can manipulate the query through injected SQL syntax. Resolved by strictly casting all IDs to integers and using parameterized ->whereIn() queries.
- CVE-2026-90901High
The Easy Store extension for Joomla (versions 1.0.0-3.0.0) has a SQL Injection vulnerability in media image deletion. The checkout.searchGuestUser endpoint allows querying guest checkout records solely by supplying an email address. The server returns complete shipping details (full name, phone number, street address, city, postal code, country) from the #__easystore_guests table without authentication, session validation, or ownership checks. An unauthenticated attacker can iterate through email lists to enumerate guest customers and harvest sensitive PII. Resolved by removing the unauthenticated server-side guest lookup endpoint and migrating autofill to client-side localStorage with explicit user consent.
- CVE-2026-90900Medium
The Joomla Easy Store extension (joomshaper.com) in versions 1.0.0-3.0.0 contains a Missing CSRF Token Verification vulnerability in the product review submission endpoint (index.php?option=com_easystore&task=product.addReview). The endpoint accepted submissions without verifying an anti-CSRF token (the check had been commented out in code). An attacker could trick a logged-in user into posting unauthorized reviews or submitting review spam via cross-site requests. Resolved by enforcing Session::checkToken('request') / Session::checkToken('post') in ProductController, injecting HTMLHelper::_('form.token') into the review form template, and appending the session token to the submission payload in review-form.js.
- CVE-2026-90899High
The Easy Store extension for Joomla (versions 1.0.0-3.0.0) has an unauthenticated PII exposure vulnerability via IDOR in guest checkout. The checkout.searchGuestUser endpoint allows querying guest checkout records solely by supplying an email address. The server returns complete shipping details (full name, phone number, street address, city, postal code, country) from the #__easystore_guests table without authentication, session validation, or ownership checks. An unauthenticated attacker can iterate through email lists to enumerate guest customers and harvest sensitive PII. Resolved by removing the unauthenticated server-side guest lookup endpoint and migrating autofill to client-side localStorage with explicit user consent.
- CVE-2026-65761Critical
The Easy Store extension for Joomla versions 1.0.0-2.0.1 contains an unauthenticated SQL injection via improper validation of order parameters, allowing full database read access including credentials and sessions.
- CVE-2026-65759High
The Easy Store extension (versions 1.0.0-2.0.1) for Joomla! allows unauthenticated attackers to forge payments and orders by processing client-side data. Attackers can manipulate payment and order states.
Original NVD description (English source)
Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.php?option=com_easystore&task=appconfig.updateConfiguration updated core Joomla mail configuration (fromname, mailfrom) in configuration.php without verifying anti-CSRF tokens or checking for administrative permissions (canAdmin). A malicious site could silently modify the site's sender name and email address via forged requests from an admin's browser. Resolved by enforcing Session::checkToken('request') / Session::checkToken('post') and adding explicit administrative authorization verification via AccessControl::create()->canAdmin().