Which versions of EasyStore (Joomla) are affected by CVE-2026-65760?

JoomShaper's EasyStore extension for Joomla (versions 1.0.0-2.0.1) contains a critical broken-access-control vulnerability allowing any authenticated store user to view all customer orders and…

How to fix or mitigate CVE-2026-65760?

Within 24 hours, identify and audit all Joomla instances running EasyStore versions 1.0.0-2.0.1 and immediately restrict store access to administrative accounts only, or take the extension offline if not mission-critical. Within 7 days, implement compensating controls: enforce database-level access restrictions on customer order and profile tables, enable comprehensive audit logging for all customer data queries, and configure WAF rules to block low-privilege access to customer-enumeration endpoints. Within 30 days, continuously monitor vendor security advisories for a patch release, evaluate and prepare to migrate to alternative e-commerce extensions, and establish additional defensive controls such as multi-factor authentication and IP whitelisting for store administrative access.

EasyStore (Joomla) CVE-2026-65760

Q: What is the CVSS score of CVE-2026-65760?

CVE-2026-65760 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-48313 CRITICAL

Improper Access Control (CWE-284)

2026-07-23 Joomla

GHSA-cvp9-2qg7-7pmr

Authentication Bypass Information Disclosure Easy Store Extension For Joomla Joomshaper Com

9.2

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Any authenticated user can read all orders, so PR:L (not PR:N) and AC:L; confidentiality-only PII disclosure gives C:H with I:N/A:N and no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:16 vuln.today

CVE Published

Jul 23, 2026 - 16:38 cve.org

CRITICAL 9.2

DescriptionCVE.org

Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any order in the system.

AnalysisAI

Broken access control in JoomShaper's EasyStore extension for Joomla (versions 1.0.0 through 2.0.1) lets any authenticated Joomla user enumerate and read the orders and customer records belonging to other customers. Because order objects are returned without an ownership/authorization check, a single low-privilege account can harvest names, contact details and purchase data across the entire store. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the disclosure is public via a third-party security writeup.

Technical ContextAI

EasyStore is an e-commerce extension for the Joomla CMS published by JoomShaper (joomshaper.com), adding a storefront, cart and order-management workflow on top of Joomla's user/session model. The root cause is CWE-284 (Improper Access Control): the component's order/customer retrieval logic authenticates that a request comes from a logged-in user but fails to verify that the requesting user actually owns the order being requested - a classic missing object-level authorization (IDOR-style) check. The single affected CPE is cpe:2.3:a:joomshaper.com:easy_store_extension_for_joomla:*:*:*:*:*:*:*:*, spanning the full 1.0.0-2.0.1 range. An attacker manipulates the order identifier used by EasyStore's data layer to pull records that server-side code should have scoped to the current customer.

RemediationAI

Upgrade EasyStore to a release later than 2.0.1 once the vendor publishes it; no exact fixed version is confirmed in the available data, so consult the vendor product page at https://www.joomshaper.com/easystore and the disclosure at https://mysites.guru/blog/easystore-security-disclosure/ for the patched build and apply it. Until a patched version is confirmed and installed, reduce exposure by disabling open self-registration on the Joomla site (Users > Manage > Options > Allow User Registration = No) so an attacker cannot trivially obtain the authenticated foothold the flaw requires - trade-off: legitimate new customers can no longer self-enroll and must be provisioned manually. Where feasible, restrict or take the EasyStore storefront order-view functions offline for logged-in users, and audit existing low-privilege accounts and web/access logs for anomalous sequential order-ID access indicative of enumeration. Treat any exposed customer data as breached for notification purposes if enumeration is observed.