JoomShaper EasyStore CVE-2026-90901

Exploitable against any Joomla site running JoomShaper EasyStore 1.0.0-3.0.0 that exposes the checkout.searchGuestUser endpoint, where guest checkout has been used so the #__easystore_guests table contains records. No authentication, session, or ownership check is required - the description states the lookup is unauthenticated and returns full shipping PII by email alone. The only practical prerequisite/limit is that the attacker must supply candidate email addresses to query (enumeration is by known/guessed emails), and only guest-checkout customer PII is exposed - no system access, code execution, or data modification is possible. Note: this contradicts the vendor CVSS PR:H, which appears to be tied to the mislabeled 'SQL injection' framing.

This CVE has severe internal data conflicts that must be resolved before prioritization. The CVE title labels it 'Authenticated, Privileged SQL Injection in Media Image Deletion,' the CWE is CWE-74 (injection), and the vendor CVSS 4.0 vector (8.6, PR:H, VC:H/VI:H/VA:H full triad) describes a privileged full-impact injection flaw. The DESCRIPTION contradicts all of this: it describes an UNAUTHENTICATED information-disclosure endpoint (checkout.searchGuestUser) that returns guest PII from #__easystore_guests with 'no authentication, session validation, or ownership checks,' explicitly stating 'An unauthenticated attacker could iterate through email lists.' This is a read-only broken-access-control/info-disclosure issue (CWE-200/CWE-862), NOT SQL injection, NOT authenticated, and NOT integrity- or availability-impacting. The vendor vector's PR:H is directly contradicted by the description's 'unauthenticated attacker'; VI:H/VA:H are unsupported by a read-only lookup. Treating the DESCRIPTION as authoritative, real risk is a confidentiality-only PII harvesting flaw: unauthenticated, network-reachable, low-complexity, no user interaction - trivially scriptable for mass enumeration but limited to PII exposure (GDPR/privacy impact), not system compromise. No EPSS, no KEV listing, and no public POC are provided, so there is no evidence of active exploitation; SSVC data is absent. Net: a genuine and easily automated unauthenticated PII-leak worth patching for privacy/compliance reasons, but the headline 8.6 with full triad and 'SQLi' framing overstates it - the real impact is confidentiality-only.

An unauthenticated attacker who knows or guesses customer email addresses (e.g., from a breach list or scraped list) sends repeated requests to the checkout.searchGuestUser endpoint of an EasyStore-powered Joomla store, receiving full shipping PII (name, phone, street, city, postal code, country) for each matching guest. By iterating through large email lists, they enumerate and harvest the store's entire guest-customer PII dataset. No POC is published, but the attack is trivially scriptable given the described lack of any authentication or ownership check.