CSRF Vulnerability in Easy Store Extension for Joomla by JoomShaper

CVE-2026-90903

What is CVE-2026-90903?

The Easy Store extension for Joomla, developed by JoomShaper, has a notable vulnerability due to missing CSRF token verification across several administrator AJAX API endpoints. Specifically, the ApiController only validated CSRF tokens for the products() action, while other crucial endpoints managing orders, coupons, media, customers, settings, tags, categories, reviews, and collections were left exposed. This oversight allows potential attackers to impersonate authenticated administrators and initiate unauthorized state changes within the store's backend. The vulnerability has been addressed by enforcing global CSRF token verification for all state-changing HTTP methods (POST, PUT, PATCH, DELETE) in the ApiController.

References