Which versions of EasyStore are affected by CVE-2026-65761?

Easy Store extension for Joomla (versions 1.0.0-2.0.1) contains an unauthenticated SQL injection vulnerability enabling direct database access, including customer credentials and active session…

Is there a public PoC exploit available for CVE-2026-65761?

Yes, a public proof-of-concept exploit is available for CVE-2026-65761. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-65761?

Within 24 hours, identify all Joomla installations running Easy Store versions 1.0.0-2.0.1 and assess active usage; disable or remove the extension immediately if not operationally required. Within 7 days, deploy Web Application Firewall rules to block SQL injection patterns in order parameters, harden application-layer input validation on all order processing inputs, and enable rate limiting on order submission endpoints. Within 30 days, monitor JoomShaper's security advisories for patch availability; plan upgrade to the patched version immediately upon release and conduct forensic review of database query logs for indicators of unauthorized access during the interim period.

EasyStore CVE-2026-65761

Q: What is the CVSS score of CVE-2026-65761?

CVE-2026-65761 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-48314 CRITICAL

SQL Injection (CWE-89)

2026-07-23 Joomla

GHSA-pmcx-2353-j242

SQLi Easy Store Extension For Joomla Joomshaper Com

9.3

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Unauthenticated network SQLi (AV:N/AC:L/PR:N/UI:N); full DB read gives C:H, injection permits limited data tampering (I:L), no availability impact and no scope change per description.

3.1 AV:N/AC:L/PR:N/UI:N/S:N/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:17 vuln.today

CVE Published

Jul 23, 2026 - 16:38 cve.org

CRITICAL 9.3

DescriptionCVE.org

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated SQL injection in easystore, allowing full DB read access including credentials and sessions.

Articles & Coverage 1

medium.com CVE-2026-65761: EasyStore Joomla Extension Pre-Auth SQL Injection via filter_sortby Parameter Aug 11, 2026

AnalysisAI

Unauthenticated SQL injection in the Easy Store extension for Joomla (versions 1.0.0 through 2.0.1) by JoomShaper allows remote attackers to inject arbitrary SQL through improperly validated order parameters, yielding full read access to the backend database including credentials and active session tokens. No public exploit has been identified at time of analysis, but the flaw is trivially reachable over the network without authentication and against default installations. Successful exploitation enables complete disclosure of stored user data and hijacking of authenticated sessions.

Technical ContextAI

Easy Store is a native e-commerce/shopping extension for the Joomla CMS, typically deployed as a component on PHP-based Joomla sites backed by a MySQL/MariaDB database. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), where user-supplied order-related parameters (e.g., ordering/sort fields) are concatenated into a SQL query without proper parameterization or whitelisting. Because order-by and filter parameters are commonly built as raw string fragments rather than bound placeholders, they are a classic SQLi sink; here they are reachable by an unauthenticated request path. The affected product is identified by CPE cpe:2.3:a:joomshaper.com:easy_store_extension_for_joomla and the vendor is JoomShaper (joomshaper.com).

RemediationAI

Upgrade Easy Store to a release later than 2.0.1 that contains the fix; a specific vendor-released patched version number is not stated in the available data, so consult the vendor page at https://www.joomshaper.com/easystore and the disclosure at https://mysites.guru/blog/easystore-security-disclosure/ for the exact fixed build (Patch available per vendor advisory - released patched version not independently confirmed from this input). Until patched, restrict or block unauthenticated access to the Easy Store storefront endpoints at the web server or WAF layer, and deploy WAF SQL-injection signatures targeting the order/sort parameters (trade-off: WAF rules can be bypassed and may break legitimate sorting requests). Because credentials and session tokens may already be exposed, rotate/invalidate all active Joomla sessions and force a password reset for site users after patching. As a stronger compensating control, take the Easy Store component offline if the store is non-essential, accepting loss of shop functionality.