EasyStore EUVD-2026-48316

Exploitation requires only network access to a Joomla site running EasyStore 1.0.0-2.0.1 with its checkout/order-processing functionality reachable - no authentication, no user interaction, and no special non-default configuration are indicated by the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N). The specific concrete prerequisite is that the extension processes order and payment state (including status transitions) from client-side input, so the attacker must be able to reach the endpoint that accepts these order/payment-status parameters and know or guess a valid order identifier. The main limiting factor is that impact is confined to integrity of order/payment state (VC:N/VA:N) - no data disclosure or service outage - and that the target must actually have EasyStore deployed and handling orders; sites not using EasyStore or on a fixed version are unaffected.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N) scores this 8.7, indicating remote, low-complexity, unauthenticated exploitation with high impact strictly to integrity - confidentiality and availability are unaffected, which is consistent with an order/payment forgery flaw that manipulates state without leaking data or downing the service. No EPSS score, SSVC decision, POC, or KEV signal was provided; there is no public exploit identified and no evidence of active exploitation, so exploitation likelihood beyond the raw vector cannot be quantified from this data. The signals are internally consistent (network + no-auth + integrity-only), so this is a genuine priority for any live storefront rather than an inflated high-CVSS-but-low-real-risk case: the business impact (fraudulent 'paid' orders, financial loss) is direct, even though there is no code execution or data exposure. The main uncertainty is exploitation prevalence - absence of EPSS/KEV suggests it is not yet widely weaponized, but the low attack complexity means that could change quickly once disclosure details circulate.

An attacker who has never authenticated to the store crafts an HTTP request to EasyStore's order-processing endpoint, supplying forged payment-status and order-status values for a target order ID. The server trusts these client-supplied fields and advances the order to a 'paid'/'completed' state, allowing the attacker to obtain goods or services without payment or to disrupt legitimate orders. No public POC has been identified, but the low attack complexity and lack of authentication make the request trivial to reproduce once the endpoint and parameters are known.