Executive brief
A vulnerability in the Easy Store e-commerce extension for Joomla allows unauthorized individuals to manipulate order and payment information. An attacker could mark orders as paid without actually providing payment or modify order details, leading to financial loss and disruption of business operations. This issue affects online shops using the extension to process customer transactions.
Technical details
The Easy Store extension (versions 1.0.0 through 2.0.1) fails to properly validate order and payment states on the server side, instead processing critical information from client-side input. Specifically, an anonymous request to the 'order-repayment' endpoint can be used to mark any order as paid without interacting with a payment gateway. This unauthenticated order forgery allows attackers to manipulate order states and rewrite order fields by simply changing an ID. The vulnerability was addressed in version 2.0.2 by enforcing a token requirement and verifying order ownership.
Affected products
- JoomShaper Easy Store extension for Joomla 1.0.0-2.0.1
Timeline
- 2026-07-21: disclosed: Privately reported to vendor by mySites.guru
- 2026-07-23: patched: Fixed in version 2.0.2
- 2026-07-23: advisory