CVE-2026-65760
A Joomla extension called Easy Store (versions 1.0.0 to 2.0.1) can expose order and customer details to any logged‑in user because it lacks proper access checks.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Joomla sites using the Easy Store extension from joomshaper.com, versions 1.0.0 through 2.0.1.
Real-world impact
An attacker who can log into the site can view any customer's order history and personal information, potentially leading to privacy violations or fraud.
Why this severity
The CVSS score of 9.2 reflects the high impact of the vulnerability: it allows complete disclosure of sensitive data (high confidentiality impact) with no authentication or privilege escalation required, and no user interaction is needed.
What to do about it
- ›Restrict access to the Easy Store extension to trusted administrators only; disable or remove the extension if it is not needed; monitor for unauthorized access.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources