Is CVE-2026-65760 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65760 being exploited in the wild.

How severe is CVE-2026-65760?

Informational severity, with a CVSS score of 9.2, published 23 July 2026.

Which products and versions are affected?

JoomShaper Easy Store 1.0.0-2.0.1.

Is there a fix for CVE-2026-65760?

A patch was published on 2026-07-23: Vendor released version 2.0.2 containing the fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-65760 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-65760?

Check whether you run JoomShaper Easy Store at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65760: JoomShaper Easy Store improper access control in order views

CVE-2026-65760 · Severity: info · CVSS 9.2 · Published 2026-07-23

A vulnerability in the Easy Store extension for Joomla allows any registered user to view the personal information and order history of every other customer. By simply changing a number in the website's address, an attacker can access sensitive data including full names, email addresses, physical addresses, and phone numbers. This flaw poses a significant risk of a data breach and could lead to regulatory compliance issues for online shop owners.

Technologies: JoomShaper Easy Store. Vendors: JoomShaper.

Quick answers

Is CVE-2026-65760 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65760 being exploited in the wild.
How severe is CVE-2026-65760?: Informational severity, with a CVSS score of 9.2, published 23 July 2026.
Which products and versions are affected?: JoomShaper Easy Store 1.0.0-2.0.1.
Is there a fix for CVE-2026-65760?: A patch was published on 2026-07-23: Vendor released version 2.0.2 containing the fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65760 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-65760?: Check whether you run JoomShaper Easy Store at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Easy Store extension for Joomla (versions 1.0.0 through 2.0.1) fails to perform adequate ownership checks on order and invoice views. While the system verifies that a user is logged in, it does not confirm that the requested order ID belongs to the authenticated user. Because order IDs are sequential integers, an attacker can perform an Insecure Direct Object Reference (IDOR) attack by incrementing the ID in the URL to access sensitive customer data (CWE-200, CWE-284). This exposure includes names, emails, billing/shipping addresses, and phone numbers. The vulnerability was addressed in version 2.0.2 by enforcing user ownership verification.

Affected products

JoomShaper Easy Store extension for Joomla 1.0.0-2.0.1

Timeline

2026-07-21: disclosed: Vulnerability reported privately to vendor by mySites.guru
2026-07-22: other: Vendor confirmed reproduction of the issue
2026-07-23: patched: Vendor released version 2.0.2 containing the fix
2026-07-23: advisory: Public disclosure and CVE assignment

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.