CVE-2026-90901 in Easy Store Extension
Summary
by MITRE • 09/23/2026
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest checkout records solely by supplying an email address. The server returned complete shipping details (full name, phone number, street address, city, postal code, and country) directly from the #__easystore_guests table with no authentication, session validation, or ownership checks. An unauthenticated attacker could iterate through email lists to enumerate guest customers and harvest sensitive Personally Identifiable Information (PII). Resolved by removing the unauthenticated server-side guest lookup endpoint entirely and migrating autofill functionality to client-side localStorage protected by explicit user consent.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in the Easy Store extension for Joomla, specifically within versions 1.0.0 through 3.0.0, represents a critical failure in access control and data validation mechanisms. The core technical flaw resides in the checkout.searchGuestUser endpoint, which was designed to facilitate user experience by allowing customers to retrieve their shipping details using an email address during the guest checkout process. However, this functionality lacked essential security controls such as authentication requirements, session validation, or ownership verification checks. Consequently, any actor with network access to the Joomla installation could interact with this API endpoint without providing valid credentials or a legitimate user session. The server processed requests by directly querying the #__easystore_guests database table and returning the full result set associated with the provided email address. This design oversight meant that sensitive Personally Identifiable Information, including full names, phone numbers, street addresses, cities, postal codes, and countries, was exposed to unauthorized parties simply through HTTP POST or GET requests containing an email parameter.
From a technical perspective, this vulnerability is classified as an insecure direct object reference combined with broken access control, aligning closely with CWE-284 Improper Access Control and CWE-601 URL Redirection to Untrusted Site. The absence of server-side validation regarding whether the requesting entity owns the data being accessed allows for systematic enumeration attacks. An unauthenticated attacker can automate queries against a list of known or guessed email addresses to harvest large volumes of customer data. This capability transforms what was intended as a convenience feature into a significant privacy breach and potential tool for social engineering, identity theft, or targeted phishing campaigns. The impact extends beyond mere data exposure; it undermines the integrity of the e-commerce platform by violating fundamental principles of data confidentiality and user trust.
The operational impact of this vulnerability is severe due to the sensitivity of the exposed data fields. Shipping addresses and contact information are high-value targets for malicious actors seeking to conduct physical fraud, such as package interception or delivery-based scams. Furthermore, the aggregation of PII from multiple users can facilitate broader identity theft operations. The lack of rate limiting or input sanitization in some implementations could also potentially lead to secondary issues like database performance degradation if an attacker floods the endpoint with requests, although the primary concern remains data exfiltration. This scenario is consistent with ATT&CK technique T1078 Valid Accounts when considering that while no account was needed for access, the system treated unauthenticated inputs as valid queries against protected resources, effectively bypassing intended security boundaries.
Mitigation strategies implemented in subsequent versions focus on eliminating the root cause by removing the vulnerable server-side endpoint entirely. This architectural change ensures that sensitive lookups are not performed via direct database queries exposed to external networks. Instead, autofill functionality has been migrated to client-side storage mechanisms such as localStorage, which operates within the browser's security context and requires explicit user consent before data is populated or accessed. This shift reduces the attack surface significantly by moving logic away from the server where it can be exploited remotely. For administrators still running affected versions, immediate remediation involves updating the Easy Store extension to a patched version that incorporates these changes. Additionally, implementing Web Application Firewall rules to block requests targeting the checkout.searchGuestUser endpoint with suspicious patterns can provide temporary protection until an upgrade is feasible. Regular security audits and adherence to OWASP guidelines for API security are recommended to prevent similar access control failures in future development cycles.