EasyStore CVE-2026-90903

Requires a Joomla administrator to be actively authenticated to the backend AND to be tricked into visiting an attacker-controlled page or clicking a malicious link (UI:P) while that session is valid. Applies to EasyStore extension versions 1.0.0 through 3.0.0 where any administrative AJAX endpoint other than products() (i.e. orders, coupons, media, customers, settings, tags, categories, reviews, collections) processes state-changing HTTP methods. Limiting factors: exploitation fails if the admin is not logged in, if the admin does not interact with the attacker's content, or once the site is updated to the patched build that enforces global CSRF verification in ApiController::execute().

This is a classic CSRF (CWE-352) flaw with a moderate real-world risk profile. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:H, 7.2) correctly captures the defining CSRF characteristics: the attacker themselves is unauthenticated (PR:N) but exploitation is gated on user interaction (UI:P) by a currently-logged-in Joomla administrator, which is the single biggest real-world limiter. No EPSS score, no CISA KEV listing, and no public exploit code are provided, so exploitation status is 'no public exploit identified at time of analysis' - this is not confirmed active exploitation. The VI:H/VA:H impact rating is defensible because forged requests can create/modify/delete orders, coupons, customers, settings, categories, reviews and collections, but I lean toward VA:L rather than VA:H since CSRF-driven state changes are integrity-centric and only indirectly affect availability. Overall this is a genuine-but-conditional issue rather than a drop-everything emergency: high integrity impact is real, but the requirement to phish an authenticated admin into visiting an attacker page, combined with the niche deployment footprint of this specific Joomla e-commerce extension, keeps practical risk in the medium band. Only vendor-confirmed data (JoomShaper/Joomla) is available; there is no independent NVD enrichment or third-party analysis.

An attacker crafts a malicious web page containing auto-submitting forms (or fetch/XHR calls) targeting EasyStore's unprotected administrator AJAX endpoints such as orders, coupons, settings, or customers. They lure a currently-authenticated Joomla administrator to that page, and the victim's browser silently issues state-changing POST/PUT/PATCH/DELETE requests using the admin's session - modifying store data without any CSRF token. No public exploit code is referenced, but a working proof-of-concept is trivial to build given the plain missing-token nature of the bug.