Joomla Easy Store CVE-2026-90902

Requires an authenticated Joomla administrator with access to the Easy Store (com_easystore) component's coupon management, and the Easy Store extension version 1.0.0 through 3.0.0 must be installed. The attacker reaches the flaw via the administrative task administrator/index.php?option=com_easystore&task=coupon.couponBulkUpdate by supplying non-integer, SQL-bearing values in the bulk coupon ID input. The primary limiting factor is the high privilege requirement (administrator), which sharply narrows the attacker population and reduces net escalation value since Joomla admins already have extensive database access.

This is a genuine SQL injection (the input reports CWE-74 injection; the described flaw is classic CWE-89 SQLi) but its real-world priority is moderate-to-low, not the 8.6 headline suggests. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) drives the high score through full C/I/A impact, but the critical mitigating factor is PR:H - exploitation requires an already-authenticated Joomla administrator. In Joomla an administrator typically already has broad database and configuration access, so the SQLi mainly upgrades an admin to cleaner arbitrary DB read/write rather than granting a fresh boundary crossing. Corroborating low-urgency signals: EPSS is 0.25% (14th percentile), SSVC decides Exploitation=none, Automatable=no, Technical Impact=partial, there is no CISA KEV listing, and no public exploit code. All signals are consistent - high nominal severity but low likelihood and limited privilege escalation value. No conflicting data was found; the CVSS network vector is consistent with an admin HTTP endpoint (administrator/index.php).

An attacker who already holds (or has phished/compromised) a Joomla administrator account with access to the Easy Store component crafts a request to administrator/index.php?option=com_easystore&task=coupon.couponBulkUpdate, embedding SQL syntax inside the coupon ID list instead of plain integers. Because the IDs are concatenated directly into a raw IN (...) clause, the injected syntax executes against the database, enabling data exfiltration or modification beyond the coupon table. No public exploit code is identified at time of analysis, and exploitation is not automatable per SSVC.