EasyStore (com_easystore) below 2.0.2 - Unauthenticated SQL Injection, Unauthenticated Order Forgery and Cross-Customer Invoice Disclosure
EasyStore, the JoomShaper ecommerce component for Joomla, is affected by three flaws in version 2.0.1 and every earlier release, found and reported by mySites.guru. (1) Unauthenticated order forgery: the checkout repayment task built the order from client-supplied JSON including the payment status and wrote it to the database with no login, no CSRF token, no ownership check and no contact with any payment gateway, so an anonymous request could mark any order paid (goods released without payment) and rewrite arbitrary fields on any order id. CWE-862 and CWE-639, CVSS 4.0 8.7 High. (2) Unauthenticated SQL injection: the product list sort parameter passed its direction into the query ORDER BY clause without an allow-list, giving an anonymous visitor a read of any table in the database including Joomla user accounts, password hashes and the site secret. CWE-89, CVSS 4.0 8.7 High. (3) Cross-customer order and invoice disclosure: the order detail page and printable invoice checked only that a user was logged in, never that the order belonged to them, and order ids are sequential, so any registered customer could read every other customer name, email address, billing and shipping address, phone number and purchase history. CWE-639, CVSS 4.0 7.1 High. Update to EasyStore 2.0.2 or later, released 23 July 2026. JoomShaper shipped 2.0.2 with no security advisory and described the three fixes as routine changelog lines. A web application firewall filtering SQL may block the injection but does nothing about the order forgery or the invoice exposure, so it is mitigation rather than a fix. Both the invoice exposure and the SQL injection are silent reads that leave no file changes, so a clean file scan does not indicate a site was unaffected. A CVE has been applied for through the Joomla CNA and is not yet assigned. Assigned CVE-2026-65759, CVE-2026-65760, CVE-2026-65761 (all affect <= 2.0.1, fixed 2.0.2).
Affected versions: < 2.0.2
Full advisory: our disclosure post
