EasyStore CVE-2026-90905

Exploitation requires an authenticated Joomla administrator (holding an active admin session) to be tricked into loading an attacker-controlled page while logged in - this is the UI:P/user-interaction gate. The attacker itself needs no credentials (PR:N) but cannot trigger the flaw without the victim admin's browser and session. The specific vulnerable target is the administrator/index.php?option=com_easystore&task=appconfig.updateConfiguration endpoint in EasyStore versions 1.0.0 through 3.0.0, which prior to the fix performed neither anti-CSRF token validation (Session::checkToken) nor administrative authorization (AccessControl canAdmin). Impact is limited to overwriting the Joomla mail sender name and address in configuration.php.

This is a CSRF combined with a missing-authorization flaw (CWE-352) in the JoomShaper EasyStore Joomla extension. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:H) scores 7.2, but that rating looks inflated relative to the actual impact: the vulnerable endpoint only lets a forged request rewrite the Joomla mail sender name (fromname) and sender address (mailfrom) in configuration.php. VI:H/VA:H imply full integrity and availability loss, yet the described effect is a narrow configuration tampering that at most enables spoofed outbound mail or broken mail delivery - closer to I:L (and possibly A:L), with no confidentiality exposure to justify VC:L. The attacker is unauthenticated (PR:N) but the attack is entirely gated on an authenticated administrator being lured into loading a malicious page while logged in (UI:P/UI:R), which is a meaningful real-world limiter. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so there is no evidence of active or automated exploitation. Net: a legitimate but low-to-moderate priority bug - patch in routine cycles rather than emergency. Note the impact metrics conflict between the vendor vector (VI:H/VA:H) and the description (mail-config change only) - verify scope with JoomShaper before treating this as a high-integrity flaw.

An attacker hosts a web page containing a hidden form or auto-submitting request targeting administrator/index.php?option=com_easystore&task=appconfig.updateConfiguration. A logged-in Joomla administrator is socially engineered into visiting the page, and their browser silently submits the forged request, changing the site's mail 'fromname' and 'mailfrom' so outbound Joomla email is spoofed or misdirected. No public exploit code is identified at time of analysis, and success requires the victim to hold an active admin session.