EasyStore CVE-2026-65761

Exploitation requires only that the Easy Store extension (version 1.0.0-2.0.1) be installed and its storefront reachable over the network - no authentication, no user interaction, and no non-default configuration are needed, consistent with AV:N/AC:L/AT:N/PR:N/UI:N. The specific prerequisite is a request to the vulnerable order-parameter handling code path in easystore, where order/sort parameters are improperly validated. Limiting factors: the site must have the Easy Store component installed and internet-accessible, and the attacker must reach the affected storefront endpoint; there are no privilege or interaction barriers reducing risk, so any exposed vulnerable install is at risk.

The CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H (base 9.3, Critical) indicates a network-reachable, low-complexity attack requiring no privileges and no user interaction, with high impact to confidentiality, integrity, and availability of the vulnerable system. Note that while the vector marks VI:H and VA:H, the description characterizes the concrete impact as full database READ access (credentials and sessions) - a strong confidentiality/data-integrity concern - so the integrity/availability ratings should be verified against actual query capability (an injection often permits limited writes or stacked queries, but the disclosure lists read access). This is not in CISA KEV (no active exploitation confirmed) and no EPSS score was provided, so real-world exploitation probability cannot be quantified from the input; however, unauthenticated SQLi in an internet-facing CMS extension is a high-priority class historically targeted by mass scanners once a POC surfaces. Treat as a real, high-priority patch item on exposure grounds even though no exploit or EPSS signal is currently available.

An unauthenticated attacker sends a single crafted HTTP request to the storefront, injecting malicious SQL into an order/sort parameter of an Easy Store listing endpoint. Using UNION-based or boolean/time-based techniques, they extract the Joomla user table and session store, harvesting password hashes and valid session tokens to impersonate administrators. No public exploit is identified at time of analysis, but the low attack complexity makes weaponization straightforward once endpoint details are known.