CVE-2026-90903
Awaiting Analysis Awaiting Analysis - Queue

CSRF Token Missing in JoomShaper Easy Store Extension

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: Joomla! Project

Description
Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0 - The administrator ApiController only validated CSRF tokens inside the products() action. All other administrative AJAX endpoints (orders, coupons, media, customers, settings, tags, categories, reviews, and collections) accepted state-changing requests without checking anti-CSRF tokens. An attacker could trick a logged-in administrator into triggering unauthorized state modifications across the store backend. Resolved by implementing global CSRF verification in ApiController::execute() for all state-changing HTTP methods (POST, PUT, PATCH, DELETE) via Session::checkToken().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-90903
EUVD
EUVD-2026-85558

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
joomshaper easy_store From 1.0.0 (inc) to 3.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in the Easy Store Joomla extension versions 1.0.0 to 3.0.0. The issue is that most administrator AJAX API endpoints did not verify CSRF tokens, allowing unauthorized state changes if an admin was tricked into clicking a malicious link.

Detection Guidance

This vulnerability involves missing CSRF token verification in Joomla's Easy Store extension. To detect it, inspect network traffic for AJAX requests to administrator endpoints (orders, coupons, media, etc.) from logged-in administrators without CSRF tokens in POST/PUT/PATCH/DELETE requests. Check Joomla logs for unauthorized state changes in the store backend.

Impact Analysis

An attacker could exploit this to perform unauthorized actions as an administrator, such as modifying orders, coupons, customer data, or store settings without consent. This could lead to data theft, financial loss, or disruption of the online store.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR (data protection) and HIPAA (health data privacy) requirements for access controls and integrity. Non-compliance risks fines or legal penalties.

Mitigation Strategies

Update the Easy Store extension to the latest version where CSRF verification is implemented globally. If an update is unavailable, manually add CSRF token checks to all state-changing AJAX endpoints in ApiController. Restrict administrator access to trusted IPs and monitor for suspicious backend activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90903. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart