EasyStore security vulnerabilities

mySites.guru tracks 1vulnerability in com_easystore. Every connected Joomla site is checked against it on each audit, and flagged if it runs an affected version.

Check whether your sites are affected

What we check for

HighCVE-2026-65759 CVE-2026-65760 CVE-2026-65761

EasyStore (com_easystore) below 2.0.2 - Unauthenticated SQL Injection, Unauthenticated Order Forgery and Cross-Customer Invoice Disclosure

Affected versions: < 2.0.2

What we have written about EasyStore

Exposed Customer Invoices, Order Forgery and SQL Injection in EasyStore for Joomla found by mySites.guru

Before EasyStore 2.0.2, any logged-in customer could read every other customer's invoice by editing one URL. mySites.guru found this and two unauthenticated flaws. Update now.

23 Jul 2026

Running EasyStore on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

CVE identifiers: CVE-2026-65759, CVE-2026-65760, CVE-2026-65761. Rules current as of 24 August 2026.