JoomShaper Easy Store CVE-2026-90899

Requires the JoomShaper EasyStore extension (versions 1.0.0 through 3.0.0) installed on a Joomla site with guest checkout in use, so that records exist in the #__easystore_guests table. The attacker must supply candidate email addresses to the checkout.searchGuestUser endpoint; no authentication, session, ownership check, or user interaction is needed. The practical limiting factor is that data is only returned for emails that correspond to real guest customers - so yield scales with the quality and coverage of the attacker's email list - and only sites where guest checkout has been used will hold exploitable PII.

This is a genuine, easily-actioned confidentiality risk rather than a theoretical high-CVSS finding. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:H) confirms a network-reachable, unauthenticated endpoint with no user interaction that fully exposes customer PII - the hardest gating factor the vendor applied is AC:H, which I question: querying checkout.searchGuestUser needs only an email address, and iterating an email list is a standard, low-effort technique, so AC:L is more defensible and the real-world score is closer to 7.5 (3.1). No EPSS score, KEV listing, or POC is present in the provided data, so this is 'no public exploit identified at time of analysis' - but the flaw is trivially reproducible (single unauthenticated request per email) and the fix (removing the endpoint entirely) confirms the vendor treated it as a real design defect, not a false positive. There is no SSVC data provided. Net: prioritize for any deployment running EasyStore guest checkout, because exploitation is simple and the impact (bulk PII harvesting with GDPR/privacy consequences) is concrete, even though there is no evidence of active exploitation yet.

An unauthenticated attacker obtains or generates a list of candidate email addresses (from breach dumps, marketing lists, or common-address patterns) and sends each one to the checkout.searchGuestUser endpoint of a Joomla site running the EasyStore extension. For every email that matches a guest checkout record, the server returns the full name, phone number, street address, city, postal code, and country with no authentication or ownership check, letting the attacker enumerate and harvest customer PII at scale. No POC is referenced in the provided data, but the attack requires only ordinary HTTP requests.