EasyStore (com_easystore) below 2.0.2 - Unauthenticated SQL Injection, Unauthenticated Order Forgery and Cross-Customer Invoice Disclosure

EasyStore, the JoomShaper ecommerce component for Joomla, is affected by three flaws in version 2.0.1 and every earlier release, found and reported by mySites.guru. (1) Unauthenticated order forgery: the checkout repayment task built the order from client-supplied JSON including the payment status and wrote it to the database with no login, no CSRF token, no ownership check and no contact with any payment gateway, so an anonymous request could mark any order paid (goods released without payment) and rewrite arbitrary fields on any order id. CWE-862 and CWE-639, CVSS 4.0 8.7 High. (2) Unauthenticated SQL injection: the product list sort parameter passed its direction into the query ORDER BY clause without an allow-list, giving an anonymous visitor a read of any table in the database including Joomla user accounts, password hashes and the site secret. CWE-89, CVSS 4.0 8.7 High. (3) Cross-customer order and invoice disclosure: the order detail page and printable invoice checked only that a user was logged in, never that the order belonged to them, and order ids are sequential, so any registered customer could read every other customer name, email address, billing and shipping address, phone number and purchase history. CWE-639, CVSS 4.0 7.1 High. Update to EasyStore 2.0.2 or later, released 23 July 2026. JoomShaper shipped 2.0.2 with no security advisory and described the three fixes as routine changelog lines. A web application firewall filtering SQL may block the injection but does nothing about the order forgery or the invoice exposure, so it is mitigation rather than a fix. Both the invoice exposure and the SQL injection are silent reads that leave no file changes, so a clean file scan does not indicate a site was unaffected. A CVE has been applied for through the Joomla CNA and is not yet assigned. Assigned CVE-2026-65759, CVE-2026-65760, CVE-2026-65761 (all affect <= 2.0.1, fixed 2.0.2).

How CVE-2026-65759 is scored

The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

Timeline

1. 23 July 2026CVE-2026-65759 record published by its CNA
2. 23 July 2026We published: Exposed Customer Invoices, Order Forgery and SQL Injection in EasyStore for Joomla found by mySites.guru

Rule details

Our disclosure post

Exposed Customer Invoices, Order Forgery and SQL Injection in EasyStore for Joomla found by mySites.guru

Before EasyStore 2.0.2, any logged-in customer could read every other customer's invoice by editing one URL. mySites.guru found this and two more flaws.

23 Jul 2026

Other vulnerabilities in EasyStore

Updating for CVE-2026-65759 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.

References

• CVE-2026-65759 on cve.org (the official CVE record)
• CVE-2026-65759 in the NIST National Vulnerability Database
• Exposed Customer Invoices, Order Forgery and SQL Injection in EasyStore for Joomla found by mySites.guru