CVE-2026-90901

The Easy Store extension (versions 1.0.0-3.0.0 ) for Joomla by joomshaper.com is vulnerable to an SQL Injection due to the lack of authentication, session validation, or ownership checks on the checkout.searchGuestUser endpoint. An unauthenticated attacker can provide an email address to query th...

EUVD-2026-85557

Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest checkout records solely by supplying an email address. The server returned complete shipping detai...

EUVD-2026-85549

Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest checkout records solely by supplying an email address. The server returned complete shipping details full...

CVE-2026-90899

The Easy Store extension (versions 1.0.0-3.0.0 ) for Joomla by joomshaper.com contains an Insecure Direct Object Reference (IDOR) vulnerability. The checkout.searchGuestUser endpoint allows unauthenticated attackers to query guest checkout records using only an email address. Because the server l...