CVE-2026-90901
Awaiting Analysis Awaiting Analysis - Queue

Authenticated SQL Injection in JoomShaper Easy Store Extension

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: Joomla! Project

Description
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest checkout records solely by supplying an email address. The server returned complete shipping details (full name, phone number, street address, city, postal code, and country) directly from the #__easystore_guests table with no authentication, session validation, or ownership checks. An unauthenticated attacker could iterate through email lists to enumerate guest customers and harvest sensitive Personally Identifiable Information (PII). Resolved by removing the unauthenticated server-side guest lookup endpoint entirely and migrating autofill functionality to client-side localStorage protected by explicit user consent.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-90901
EUVD
EUVD-2026-85557

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
joomshaper easystore From 1.0.0 (inc) to 3.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Authenticated, Privileged SQL Injection in the Easy Store Joomla extension versions 1.0.0-3.0.0. It involves an unauthenticated endpoint that allowed querying guest checkout records by email, exposing full shipping details including PII like names, addresses, and phone numbers from the #__easystore_guests table without proper access controls.

Impact Analysis

An attacker could exploit this to harvest sensitive customer data such as full names, phone numbers, street addresses, cities, postal codes, and countries by iterating through email lists. This could lead to identity theft, fraud, or privacy violations for affected customers.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access and exposure of PII without consent or proper safeguards. It may also breach HIPAA if healthcare-related customer data was exposed, as it involves unauthorized access to sensitive personal information.

Mitigation Strategies

Immediately disable or remove the Easy Store extension versions 1.0.0 to 3.0.0 from your Joomla installation. Update to the latest patched version if available. Review server logs for unauthorized access attempts to the checkout.searchGuestUser endpoint and monitor for suspicious data exfiltration activities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90901. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart