Is CVE-2026-65761 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65761 being exploited in the wild.

How severe is CVE-2026-65761?

Informational severity, with a CVSS score of 9.3, published 23 July 2026.

Which products and versions are affected?

JoomShaper Easy Store 1.0.0-2.0.1.

Is there a fix for CVE-2026-65761?

A patch was published on 2026-07-23: Version 2.0.2 released by JoomShaper Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-65761 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-65761?

Check whether you run JoomShaper Easy Store at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65761: JoomShaper EasyStore SQL injection in product list sorting

CVE-2026-65761 · Severity: info · CVSS 9.3 · Published 2026-07-23

A vulnerability in the EasyStore e-commerce extension for Joomla allows unauthorized individuals to access the website's entire database. This includes sensitive information such as customer records, personal contact details, and encrypted administrator passwords. An attacker could use this access to steal customer data or gain full control over the website, potentially leading to a significant data breach or service disruption.

Technologies: JoomShaper Easy Store. Vendors: JoomShaper.

Quick answers

Is CVE-2026-65761 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65761 being exploited in the wild.
How severe is CVE-2026-65761?: Informational severity, with a CVSS score of 9.3, published 23 July 2026.
Which products and versions are affected?: JoomShaper Easy Store 1.0.0-2.0.1.
Is there a fix for CVE-2026-65761?: A patch was published on 2026-07-23: Version 2.0.2 released by JoomShaper Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65761 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-65761?: Check whether you run JoomShaper Easy Store at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An unauthenticated SQL injection vulnerability exists in the EasyStore extension (versions 1.0.0 through 2.0.1) for Joomla. The flaw is located in the product-list sorting functionality, where the 'order' parameter is improperly validated before being used in a SQL 'ORDER BY' clause. A remote, unauthenticated attacker can exploit this by sending specially crafted web requests to extract sensitive information from the database, including Joomla account hashes, site secrets, and customer PII. The issue was addressed in version 2.0.2 by implementing a strict allow-list for sorting options.

Affected products

JoomShaper Easy Store extension for Joomla 1.0.0-2.0.1

Timeline

2026-07-21: other: Vulnerability reported to vendor by mySites.guru
2026-07-23: patched: Version 2.0.2 released by JoomShaper
2026-07-23: disclosed: Public disclosure and CVE assignment

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.