SQL Injection Vulnerability in Easy Store Extension by Joomshaper

CVE-2026-90902

What is CVE-2026-90902?

The Easy Store extension by Joomshaper suffers from an authenticated, privileged SQL injection vulnerability. The issue arises from the coupon bulk update functionality, where raw SQL IN (...) clauses are created without proper sanitization or parameterization. Specifically, input IDs from the administrator interface are concatenated directly into the SQL query, allowing an authenticated administrator to manipulate the database query through injected SQL syntax. To mitigate this vulnerability, developers have enforced strict typecasting of IDs to integers and implemented a parameterized query construction method.

References