CVE-2026-90901
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Authenticated, privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0. The media deletion endpoint parsed the ids parameter as a comma-separated string and imploded it directly into raw SQL IN (...) clauses without integer casting or parameterization.
Risk Assessment
An authenticated administrator or attacker with access to an admin session could inject arbitrary SQL statements, potentially leading to data leakage or modification.
Recommendation
Update the Easy Store extension to a version later than 3.0.0 that fixes the vulnerability, or apply security patches from the vendor.
Other vulnerabilities in Easy Store
See all- CVE-2026-65761Critical
The Easy Store extension for Joomla versions 1.0.0-2.0.1 contains an unauthenticated SQL injection via improper validation of order parameters, allowing full database read access including credentials and sessions.
- CVE-2026-90905High
Joomla Easy Store extension (versions 1.0.0-3.0.0) lacks CSRF and access control on site configuration update, allowing modification of Joomla mail settings without token verification or admin permissions.
- CVE-2026-90904High
The Easy Store extension for Joomla (versions 1.0.0-3.0.0) has a broken access control vulnerability (ACL bypass) in the allowEdit() method in ApiController.php. This method always returns true, bypassing component-level and asset-level ACL permission checks. Any authenticated backend user can edit any EasyStore record regardless of specific ACL grants. Resolved by replacing the hardcoded boolean with proper ACL authorization checks.
- CVE-2026-90903High
The Easy Store extension for Joomla (versions 1.0.0-3.0.0) lacks CSRF token verification on most administrator AJAX endpoints. Tokens are only checked in the products() action, while other endpoints (orders, coupons, media, customers, settings, tags, categories, reviews, collections) accept state-changing requests without anti-CSRF tokens. An attacker can trick a logged-in administrator into triggering unauthorized modifications. Resolved by implementing global CSRF verification in ApiController::execute() for all state-changing HTTP methods.
- CVE-2026-90902High
The Easy Store extension for Joomla (versions 1.0.0-3.0.0) has a SQL Injection vulnerability in the coupon bulk update task (couponBulkUpdate). Input IDs are directly concatenated into raw SQL IN (...) clauses without sanitization or parameterization. An authenticated administrator can manipulate the query through injected SQL syntax. Resolved by strictly casting all IDs to integers and using parameterized ->whereIn() queries.
- CVE-2026-90900Medium
The Joomla Easy Store extension (joomshaper.com) in versions 1.0.0-3.0.0 contains a Missing CSRF Token Verification vulnerability in the product review submission endpoint (index.php?option=com_easystore&task=product.addReview). The endpoint accepted submissions without verifying an anti-CSRF token (the check had been commented out in code). An attacker could trick a logged-in user into posting unauthorized reviews or submitting review spam via cross-site requests. Resolved by enforcing Session::checkToken('request') / Session::checkToken('post') in ProductController, injecting HTMLHelper::_('form.token') into the review form template, and appending the session token to the submission payload in review-form.js.
- CVE-2026-90899High
The Easy Store extension for Joomla (versions 1.0.0-3.0.0) has an unauthenticated PII exposure vulnerability via IDOR in guest checkout. The checkout.searchGuestUser endpoint allows querying guest checkout records solely by supplying an email address. The server returns complete shipping details (full name, phone number, street address, city, postal code, country) from the #__easystore_guests table without authentication, session validation, or ownership checks. An unauthenticated attacker can iterate through email lists to enumerate guest customers and harvest sensitive PII. Resolved by removing the unauthenticated server-side guest lookup endpoint and migrating autofill to client-side localStorage with explicit user consent.
- CVE-2026-65759High
The Easy Store extension (versions 1.0.0-2.0.1) for Joomla! allows unauthenticated attackers to forge payments and orders by processing client-side data. Attackers can manipulate payment and order states.
Original NVD description (English source)
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The media deletion endpoint (administrator/index.php?option=com_easystore&task=media.deleteImage) parsed the ids parameter as a comma-separated string and imploded it directly into raw SQL IN (...) clauses in Media.php and MediaModel.php without integer casting or parameterization. An authenticated administrator or attacker with access to an admin session could inject arbitrary SQL statements.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS