EasyStore Extension CVE-2026-90900

Exploitation requires (1) the EasyStore extension for Joomla installed at version 1.0.0 through 3.0.0, and (2) a victim who is already authenticated with an active session and is tricked into loading attacker-controlled web content (UI:P) that issues a cross-site POST to task=product.addReview. The vulnerable state exists in default code because the anti-CSRF token verification was commented out in ProductController, so no special server configuration is needed - but the attack is limited to the review-submission function, yields only unauthorized or spam reviews (low integrity impact), and cannot succeed without the required user interaction and a valid victim session.

This is a genuinely low-priority issue despite being remotely triggerable. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P/VC:N/VI:L/VA:N) and CWE-352 classification are internally consistent: an unauthenticated attacker can reach the endpoint over the network, but exploitation requires tricking a logged-in victim into visiting an attacker-controlled page (UI:P), and the only impact is a low integrity effect - forging or spamming product reviews (VC:N, VA:N). No EPSS score, no CISA KEV listing, and no public POC are provided in the intelligence, so there is no evidence of active or automated exploitation; the single reference is the vendor's own product page rather than an independent advisory or exploit writeup. No signals conflict, but the impact ceiling itself is low: this is a data-integrity/spam nuisance affecting a storefront review feature, not a path to account takeover, data disclosure, or service disruption. Real-world priority is low - patch during routine maintenance rather than emergency response.

An attacker hosts a web page containing a hidden auto-submitting form (or image/fetch) targeting index.php?option=com_easystore&task=product.addReview. When a currently-logged-in EasyStore user visits the page, their browser silently submits a review under their identity because the anti-CSRF token check was commented out in ProductController. No public POC is identified, and the attack succeeds only against a victim with an active session who is lured into loading the malicious page.