Which versions of EasyStore are affected by CVE-2026-65759?

JoomShaper EasyStore extension (versions 1.0.0-2.0.1) contains an unauthenticated vulnerability enabling order and payment forgery; no public exploit has been identified at time of analysis, but any…

How to fix or mitigate CVE-2026-65759?

Within 24 hours, identify all Joomla instances running EasyStore versions 1.0.0 through 2.0.1 and enable comprehensive order and payment state change logging to detect anomalies. Over the next 7 days, deploy Web Application Firewall rules to block payment status and order state parameter manipulation, implement real-time alerting on suspicious order state transitions, and restrict order management access through network segmentation. Within 30 days, contact JoomShaper for a patch release timeline; if no patch is forthcoming, disable the extension if operationally feasible or initiate migration to an alternative Joomla commerce platform and conduct transaction audit for historical fraud indicators.

EasyStore CVE-2026-65759

Q: What is the CVSS score of CVE-2026-65759?

CVE-2026-65759 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-48316 HIGH

Improper Access Control (CWE-284)

2026-07-23 Joomla

GHSA-6wj2-f75q-5h9h

Authentication Bypass Easy Store Extension For Joomla Joomshaper Com

8.7

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Remote, unauthenticated, no-interaction manipulation of server-side order/payment state from client input gives AV:N/AC:L/PR:N/UI:N with integrity-only impact (I:H, C:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:17 vuln.today

CVE Published

Jul 23, 2026 - 16:42 cve.org

HIGH 8.7

DescriptionCVE.org

Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 - Critical order and payment information, including states, are processed from client side input, enabling unauthenticated attackers to manipulate payment and order states of arbritrary orders.

AnalysisAI

Unauthenticated order and payment forgery in JoomShaper's EasyStore extension for Joomla (versions 1.0.0 through 2.0.1) lets remote attackers manipulate the payment and order state of arbitrary orders because critical fields such as order status and payment status are trusted from client-supplied input. An unauthenticated actor can mark unpaid orders as paid or otherwise tamper with order lifecycle states, undermining transaction integrity for any store using the extension. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 4.0 base score of 8.7 (high/critical) and network, no-auth, no-interaction vector make this a high-priority integrity flaw.

Technical ContextAI

EasyStore is an e-commerce component for the Joomla CMS, developed by JoomShaper (joomshaper.com), used to build online stores with checkout, order management, and payment processing. The root cause is classified as CWE-284 (Improper Access Control): the application derives sensitive server-side state - order status and payment status - from parameters submitted by the client rather than validating and controlling those transitions server-side against a trusted source (e.g. a payment gateway callback with signature verification). The affected CPE is cpe:2.3:a:joomshaper.com:easy_store_extension_for_joomla:*, covering the extension across the 1.0.0-2.0.1 range. Because payment/order state machines should only advance on authenticated, gateway-verified events, accepting these values from the request body allows forgery of the financial outcome of a transaction.

RemediationAI

Upgrade EasyStore to a version later than 2.0.1 that contains the vendor's fix; because the input data lists affected versions 1.0.0-2.0.1 but does not include an exact patched release number, treat this as 'Patch available per vendor advisory' and confirm the fixed version directly with JoomShaper via https://www.joomshaper.com/easystore and the disclosure writeup at https://mysites.guru/blog/easystore-security-disclosure/ before deploying. Until a patched release is applied, compensating controls include restricting or monitoring the EasyStore checkout/order-update endpoints (for example via web application firewall rules that reject client-submitted order-status or payment-status parameters), reconciling order and payment state against the actual payment gateway records rather than the store's stored state, and manually reviewing recently created or state-changed orders for anomalies; note that WAF rules require knowing the exact parameter names and may break legitimate checkout flows if too broad, and manual reconciliation does not prevent forgery, only detects it after the fact.