CVE-2026-90901
Awaiting Analysis Awaiting Analysis - Queue

Authenticated SQL Injection in JoomShaper Easy Store Extension

Publication date: 2026-09-23

Last updated on: 2026-09-25

Assigner: Joomla! Project

Description
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The media deletion endpoint (administrator/index.php?option=com_easystore&task=media.deleteImage) parsed the ids parameter as a comma-separated string and imploded it directly into raw SQL IN (...) clauses in Media.php and MediaModel.php without integer casting or parameterization. An authenticated administrator or attacker with access to an admin session could inject arbitrary SQL statements.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-25
Generated
2026-10-14
AI Q&A
2026-09-23
EPSS Evaluated
2026-10-12
NVD
CVE-2026-90901
EUVD
EUVD-2026-85557

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
joomshaper easystore From 1.0.0 (inc) to 3.0.0 (inc)
joomshaper easy_store From 1.0.0 (inc) to 3.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Authenticated, Privileged SQL Injection in the Easy Store Joomla extension versions 1.0.0-3.0.0. It involves an unauthenticated endpoint that allowed querying guest checkout records by email, exposing full shipping details including PII like names, addresses, and phone numbers from the #__easystore_guests table without proper access controls.

Detection Guidance

This vulnerability involves an unauthenticated endpoint leaking guest customer PII. To detect it, inspect Joomla extensions for 'Easy Store' versions 1.0.0-3.0.0 and check server logs for requests to '/checkout.searchGuestUser' with email parameters. No direct commands are provided in the context.

Impact Analysis

An attacker could exploit this to harvest sensitive customer data such as full names, phone numbers, street addresses, cities, postal codes, and countries by iterating through email lists. This could lead to identity theft, fraud, or privacy violations for affected customers.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access and exposure of PII without consent or proper safeguards. It may also breach HIPAA if healthcare-related customer data was exposed, as it involves unauthorized access to sensitive personal information.

Mitigation Strategies

Immediately disable or remove the Easy Store extension versions 1.0.0 to 3.0.0 from your Joomla installation. Update to the latest patched version if available. Review server logs for unauthorized access attempts to the checkout.searchGuestUser endpoint and monitor for suspicious data exfiltration activities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90901. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart