Joomla Easy Store Extension: Seven High-Severity Flaws Disclosed Together
Key findings • Seven vulnerabilities disclosed simultaneously in Joomla's Easy Store extension (v1.0.0-3.0.0). • Includes two high-severity SQL injection flaws in coupon and media deletion fu…
Key findings
- Seven vulnerabilities disclosed simultaneously in Joomla's Easy Store extension (v1.0.0-3.0.0).
- Includes two high-severity SQL injection flaws in coupon and media deletion functions.
- Broken access control and missing CSRF verification affect multiple admin and API endpoints.
- Unauthenticated PII exposure via IDOR in guest checkout functionality.
- All vulnerabilities disclosed on September 23, 2026, impacting backend and storefront operations.
On September 23, 2026, a batch of seven vulnerabilities was disclosed in the Joomla Extension - joomshaper.com - Easy Store extension, affecting versions 1.0.0 through 3.0.0. These vulnerabilities, all disclosed simultaneously, present a significant risk to Joomla websites utilizing this popular e-commerce extension. The issues range in severity, with six rated High and one Medium, and include critical flaws such as SQL injection, broken access control, and Cross-Site Request Forgery (CSRF) vulnerabilities.
Several of the disclosed vulnerabilities stem from improper handling of user input and inadequate access control mechanisms within the extension's administrative and API endpoints.
Two high-severity SQL injection vulnerabilities were identified. CVE-2026-90902 allows authenticated, privileged SQL injection in the coupon bulk update functionality by directly concatenating input IDs into SQL queries. Similarly, CVE-2026-90901 permits authenticated, privileged SQL injection in the media image deletion functionality, where input IDs are directly incorporated into SQL statements.
Broken access control is another significant theme. CVE-2026-90904 describes a bypass of Joomla's component-level and asset-level Access Control Lists (ACL) in the API controller for record editing, allowing any authenticated backend user to modify records. Furthermore, CVE-2026-90905 highlights missing CSRF and access control on the site configuration update endpoint, enabling unauthorized modification of core Joomla mail settings.
Cross-Site Request Forgery (CSRF) vulnerabilities are prevalent across multiple administrative AJAX API endpoints, as detailed in CVE-2026-90903. The Easy Store extension's administrator API only validated CSRF tokens for the products action, leaving other administrative endpoints like orders, coupons, and settings vulnerable. A medium-severity CSRF vulnerability, CVE-2026-90900, also affects the storefront product review submission endpoint, which failed to verify an anti-CSRF token.
Finally, CVE-2026-90899 details an unauthenticated Insecure Direct Object Reference (IDOR) vulnerability in the guest checkout process. This flaw allows any attacker to expose Personally Identifiable Information (PII) by simply providing an email address, revealing complete shipping details for guest checkouts.
The Easy Store extension versions 1.0.0 through 3.0.0 are affected by these vulnerabilities. Users are strongly advised to update to a patched version as soon as it becomes available. Specific patch details or version numbers for the fix were not immediately available at the time of disclosure.
The simultaneous disclosure of these seven vulnerabilities underscores the importance of regularly auditing and updating extensions, especially those handling sensitive e-commerce data and administrative functions. Website administrators should prioritize applying updates for the Easy Store extension to mitigate the risks associated with SQL injection, access control bypasses, CSRF attacks, and PII exposure.
The vulnerabilities include:
- CVE-2026-90905: Missing CSRF and Access Control on Site Configuration Update
- CVE-2026-90904: Broken Access Control (ACL Bypass) in API Controller Record Editing
- CVE-2026-90903: Missing CSRF Token Verification across Administrator AJAX API Endpoints
- CVE-2026-90902: Authenticated, Privileged SQL Injection in Coupon Bulk Update
- CVE-2026-90901: Authenticated, Privileged SQL Injection in Media Image Deletion
- CVE-2026-90900: Missing CSRF Token Verification in Storefront Product Review Submission
- CVE-2026-90899: Unauthenticated PII Exposure via IDOR in Guest Checkout