CVE-2026-90903 in Easy Store Extension
Summary
by MITRE • 09/23/2026
Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0 - The administrator ApiController only validated CSRF tokens inside the products() action. All other administrative AJAX endpoints (orders, coupons, media, customers, settings, tags, categories, reviews, and collections) accepted state-changing requests without checking anti-CSRF tokens. An attacker could trick a logged-in administrator into triggering unauthorized state modifications across the store backend. Resolved by implementing global CSRF verification in ApiController::execute() for all state-changing HTTP methods (POST, PUT, PATCH, DELETE) via Session::checkToken().
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/23/2026
The Joomla Easy Store extension versions 1.0.0 through 3.0.0 contain a critical Cross-Site Request Forgery vulnerability within its administrator API controller. This security flaw stems from an incomplete implementation of anti-CSRF token verification, where the developers only applied protective measures to specific endpoints while neglecting others. Specifically, the products action correctly validated CSRF tokens before processing state-changing requests. However, this validation logic was not extended to other administrative AJAX endpoints including orders, coupons, media management, customer data handling, settings configuration, tag and category management, review submissions, and collection updates. This inconsistency creates a significant attack surface where authenticated administrators can be tricked into performing unintended actions without their explicit consent or knowledge.
From a technical perspective, the vulnerability resides in the ApiController class which handles various HTTP requests for managing e-commerce data. The flaw is characterized by the absence of Session::checkToken() calls for POST, PUT, PATCH, and DELETE methods on endpoints other than products. In standard web application security practices, state-changing operations must verify that the request originates from a legitimate source within the same session context. By omitting this check for multiple administrative functions, the extension fails to enforce proper origin validation. An attacker can craft malicious HTML pages or scripts containing hidden forms or AJAX requests targeting these vulnerable endpoints. When an administrator with active privileges visits the malicious page while logged into the Joomla backend, their browser will automatically include valid session cookies and authentication tokens in the forged request. The server processes this request as legitimate because it lacks a CSRF token check to distinguish between user-initiated actions and automated forgery attempts.
The operational impact of this vulnerability is severe due to the privileged nature of the affected endpoints. An attacker who successfully exploits this flaw can manipulate order statuses, potentially marking orders as paid or cancelled without authorization. They can create fraudulent coupons that deplete store revenue or modify coupon parameters to exploit pricing logic. Media files could be uploaded maliciously, introducing webshells or phishing content into the site's public-facing directories. Customer data might be altered or deleted, leading to loss of critical business information and potential GDPR compliance violations. Settings changes could redirect payment gateways to attacker-controlled servers for credit card skimming or alter shipping configurations to disrupt logistics. Tag, category, review, and collection modifications can damage store integrity by injecting spam content, altering product categorization for SEO poisoning, or deleting legitimate customer feedback. These actions collectively compromise the confidentiality, integrity, and availability of the e-commerce platform.
This vulnerability aligns with CWE-352 Cross-Site Request Forgery (CSRF), which describes situations where a web application accepts requests from users without verifying that they intended to submit those specific requests. It also maps to MITRE ATT&CK technique T1078 Valid Accounts, as the exploitation relies on hijacking or tricking an authenticated administrator session. The lack of proper request validation represents a fundamental failure in implementing secure state management protocols for administrative interfaces.
To mitigate this vulnerability, immediate patching is required by upgrading the Easy Store extension to version 3.0.1 or later where global CSRF verification has been implemented in ApiController::execute(). For organizations unable to upgrade immediately, manual mitigation involves modifying the source code of the affected versions. Developers should ensure that Session::checkToken() is called at the beginning of all state-changing HTTP method handlers within the API controller, not just for product-related actions. Additionally, implementing SameSite cookie attributes on session cookies can provide an additional layer of defense by preventing browsers from sending these cookies in cross-site requests. Regular security audits and code reviews focusing on CSRF token implementation across all administrative endpoints are recommended to prevent similar oversights in future development cycles.