Executive brief
A vulnerability in the Easy Store extension for Joomla allows any registered user to view the personal information and order history of every other customer. By simply changing a number in the website's address, an attacker can access sensitive data including full names, email addresses, physical addresses, and phone numbers. This flaw poses a significant risk of a data breach and could lead to regulatory compliance issues for online shop owners.
Technical details
The Easy Store extension for Joomla (versions 1.0.0 through 2.0.1) fails to perform adequate ownership checks on order and invoice views. While the system verifies that a user is logged in, it does not confirm that the requested order ID belongs to the authenticated user. Because order IDs are sequential integers, an attacker can perform an Insecure Direct Object Reference (IDOR) attack by incrementing the ID in the URL to access sensitive customer data (CWE-200, CWE-284). This exposure includes names, emails, billing/shipping addresses, and phone numbers. The vulnerability was addressed in version 2.0.2 by enforcing user ownership verification.
Affected products
- JoomShaper Easy Store extension for Joomla 1.0.0-2.0.1
Timeline
- 2026-07-21: disclosed: Vulnerability reported privately to vendor by mySites.guru
- 2026-07-22: other: Vendor confirmed reproduction of the issue
- 2026-07-23: patched: Vendor released version 2.0.2 containing the fix
- 2026-07-23: advisory: Public disclosure and CVE assignment