CVE-2026-90903 Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0

Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0 - The administrator ApiController only validated CSRF tokens inside the products action. All other administrative AJAX endpoints orders, coupons, media,...

CVE-2026-90903

The Joomla Extension - joomshaper.com 's Easy Store extension (versions 1.0.0-3.0.0 ) contains a vulnerability where the ApiController fails to verify CSRF tokens across most administrator AJAX API endpoints. While the products() action was protected, other endpoints—including orders, coupons, me...