Is CVE-2026-90899 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90899 being exploited in the wild.

How severe is CVE-2026-90899?

Informational severity, published 23 September 2026.

Which products and versions are affected?

JoomShaper EasyStore 1.0.0 through 3.0.0.

Is there a fix for CVE-2026-90899?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-90899 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-90899?

Check whether you run JoomShaper EasyStore at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90899: Joomla Easy Store insecure guest checkout IDOR

CVE-2026-90899 · Severity: info · Published 2026-09-23

The EasyStore Joomla extension for building online storefronts exposed customer shipping data—names, phone numbers, and addresses—through an unauthenticated endpoint that could be queried with just an email address. An attacker could systematically harvest personal information from guest checkout records by enumerating email addresses. The vulnerability has been fixed by removing the unauthenticated lookup endpoint and moving autofill functionality to client-side storage.

Vendors: JoomShaper.

Quick answers

Is CVE-2026-90899 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90899 being exploited in the wild.
How severe is CVE-2026-90899?: Informational severity, published 23 September 2026.
Which products and versions are affected?: JoomShaper EasyStore 1.0.0 through 3.0.0.
Is there a fix for CVE-2026-90899?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90899 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-90899?: Check whether you run JoomShaper EasyStore at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The checkout.searchGuestUser endpoint in EasyStore 1.0.0-3.0.0 performed unauthenticated direct object reference queries against the #__easystore_guests table, returning complete PII from shipping records based on email input alone. No session validation, authentication, or ownership checks were performed. An attacker could iterate email lists to enumerate and expose customer names, phone numbers, and full addresses.

Affected products

JoomShaper EasyStore 1.0.0 through 3.0.0

Timeline

2026-09-23: disclosed

References

https://www.joomshaper.com/easystore

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.