# CVE-2026-90902: Joomla Easy Store SQL injection in coupon bulk update

Source: https://junglewise.ai/threats/cve-2026-90902-joomla-extension-joomshaper-com-authenticated-privileged-sql  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90902 · Severity: info · Published 2026-09-23

Easy Store is an e-commerce extension for Joomla that manages online stores and product catalogs. An authenticated administrator can inject arbitrary SQL commands through the coupon bulk update feature, potentially accessing or modifying sensitive database records without proper input validation. The vulnerability requires administrator-level access but allows direct database manipulation once authenticated.

Technologies: [JoomShaper Easy Store](https://junglewise.ai/threats/technologies/easy-store). Vendors: [JoomShaper](https://junglewise.ai/threats/vendors/joomshaper).

## Quick answers

**Is CVE-2026-90902 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90902 being exploited in the wild.

**How severe is CVE-2026-90902?** Informational severity, published 23 September 2026.

**Which products and versions are affected?** JoomShaper Easy Store 1.0.0-3.0.0.

**Is there a fix for CVE-2026-90902?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-90902 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-90902?** Check whether you run JoomShaper Easy Store at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection flaw exists in the coupon bulk update task (administrator/index.php?option=com_easystore&task=coupon.couponBulkUpdate) in ProductCoupon.php and CouponsModel.php, where coupon IDs are concatenated directly into raw SQL IN() clauses without sanitization or parameterization. An authenticated administrator can inject malicious SQL syntax to manipulate queries. The fix casts all IDs to integers and uses parameterized whereIn() query construction to prevent injection.

## Affected products

- JoomShaper Easy Store 1.0.0-3.0.0

## Timeline

- 2026-09-23: disclosed

## References

- [https://www.joomshaper.com/easystore](https://www.joomshaper.com/easystore)

## Related threats

- [Joomla Easy Store extension missing CSRF and access control](https://junglewise.ai/threats/cve-2026-90905-joomla-extension-joomshaper-com-missing-csrf-and-access-control)
- [Joomla Easy Store extension access control bypass in ApiController](https://junglewise.ai/threats/cve-2026-90904-joomla-extension-joomshaper-com-broken-access-control-acl-bypass)
- [Joomla Easy Store extension missing CSRF token verification in AJAX endpoints](https://junglewise.ai/threats/cve-2026-90903-joomla-extension-joomshaper-com-missing-csrf-token-verification)
- [Joomla Easy Store SQL injection in media deletion](https://junglewise.ai/threats/cve-2026-90901-joomla-extension-joomshaper-com-authenticated-privileged-sql)
- [Joomla Easy Store CSRF vulnerability in product review submission](https://junglewise.ai/threats/cve-2026-90900-joomla-extension-joomshaper-com-missing-csrf-token-verification)