Is CVE-2026-90902 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90902 being exploited in the wild.

How severe is CVE-2026-90902?

Informational severity, published 23 September 2026.

Which products and versions are affected?

JoomShaper Easy Store 1.0.0-3.0.0.

Is there a fix for CVE-2026-90902?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-90902 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-90902?

Check whether you run JoomShaper Easy Store at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90902: Joomla Easy Store SQL injection in coupon bulk update

CVE-2026-90902 · Severity: info · Published 2026-09-23

Easy Store is an e-commerce extension for Joomla that manages online stores and product catalogs. An authenticated administrator can inject arbitrary SQL commands through the coupon bulk update feature, potentially accessing or modifying sensitive database records without proper input validation. The vulnerability requires administrator-level access but allows direct database manipulation once authenticated.

Technologies: JoomShaper Easy Store. Vendors: JoomShaper.

Quick answers

Is CVE-2026-90902 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90902 being exploited in the wild.
How severe is CVE-2026-90902?: Informational severity, published 23 September 2026.
Which products and versions are affected?: JoomShaper Easy Store 1.0.0-3.0.0.
Is there a fix for CVE-2026-90902?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90902 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-90902?: Check whether you run JoomShaper Easy Store at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection flaw exists in the coupon bulk update task (administrator/index.php?option=com_easystore&task=coupon.couponBulkUpdate) in ProductCoupon.php and CouponsModel.php, where coupon IDs are concatenated directly into raw SQL IN() clauses without sanitization or parameterization. An authenticated administrator can inject malicious SQL syntax to manipulate queries. The fix casts all IDs to integers and uses parameterized whereIn() query construction to prevent injection.

Affected products

JoomShaper Easy Store 1.0.0-3.0.0

Timeline

2026-09-23: disclosed

References

https://www.joomshaper.com/easystore

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.