CVE-2026-90903: Joomla Easy Store extension missing CSRF token verification in AJAX endpoints

CVE-2026-90903 · Severity: info · Published 2026-09-23

Joomla Easy Store is an e-commerce extension that manages online stores, including orders, products, and customer data. The extension failed to verify CSRF tokens on most administrative API endpoints, allowing attackers to trick logged-in administrators into making unauthorized changes to store configuration and data. An attacker could modify orders, coupons, customers, settings, and other critical store functions without the administrator's knowledge.

Technologies: JoomShaper Easy Store. Vendors: JoomShaper.

Quick answers

Is CVE-2026-90903 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-90903 being exploited in the wild.
How severe is CVE-2026-90903?
Informational severity, published 23 September 2026.
Which products and versions are affected?
JoomShaper Easy Store 1.0.0 to 3.0.0.
Is there a fix for CVE-2026-90903?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90903 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-90903?
Check whether you run JoomShaper Easy Store at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing CSRF token validation in the ApiController class affecting multiple administrative AJAX endpoints (orders, coupons, media, customers, settings, tags, categories, reviews, collections). Only the products() action performed CSRF verification, leaving state-changing requests via POST, PUT, PATCH, and DELETE methods unprotected. An authenticated administrator is required to visit a malicious page; the fix implements global CSRF checks via Session::checkToken() in the execute() method.

Affected products

  • JoomShaper Easy Store 1.0.0 to 3.0.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.