EasyStore (Joomla) EUVD-2026-48313

Exploitation requires an authenticated Joomla session on a site with EasyStore 1.0.0-2.0.1 installed - the description explicitly states 'logged in users' can retrieve any order, so a valid account is a mandatory prerequisite (contradicting the input's PR:N). No special store configuration, user interaction, or elevated privileges are needed beyond a basic registered account, and the attacker only needs to alter the order identifier in a request. Limiting factors: sites that disable public self-registration or gate account creation force the attacker to first obtain credentials, and sites not running the EasyStore extension are entirely unaffected.

The provider-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H) yields 9.2 (Critical) and treats the issue as network, unauthenticated with high confidentiality impact. This directly conflicts with the description, which states exploitation requires a 'logged in' user - so PR:N is almost certainly wrong and should be PR:L; verify with the vendor. Correcting for authentication, real-world severity is high but not truly critical: the barrier is merely obtaining any store account (often self-registration), so the practical bar is low, but it is not unauthenticated. Impact is confidentiality-only (order and PII disclosure) with no integrity or availability effect, and the SC:H (subsequent-system confidentiality) rating is questionable since the data stays within the same application. No EPSS score, KEV entry, SSVC decision, or POC was provided; exploitation status is 'no public exploit identified at time of analysis.' Net: a genuine bulk-PII-exposure priority for anyone running EasyStore, driven by low exploitation complexity rather than by confirmed active abuse.

An attacker registers (or reuses) an ordinary customer account on a Joomla site running EasyStore, places or views their own order to learn the order-reference format, then iterates the order identifier in requests to EasyStore's order/customer retrieval endpoint. Each altered request returns another customer's order and personal information, letting the attacker script a full dump of the store's order history. No POC is published, but the low attack complexity makes trivial enumeration realistic.