CVE-2026-65761
A Joomla extension called Easy Store (versions 1.0.0‑2.0.1) contains an unauthenticated SQL injection flaw. Attackers can manipulate order parameters to read the entire database, including user credentials and session data. The vulnerability is critical because it can be exploited without authentication.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Joomla Easy Store extension versions 1.0.0 through 2.0.1, used on Joomla sites.
Real-world impact
An attacker could read all database contents, including usernames, passwords, and session tokens, potentially taking full control of the site.
Why this severity
The CVSS score of 9.3 reflects the high impact on confidentiality, integrity, and availability, combined with the lack of authentication or other mitigations.
What to do about it
- ›Disable or remove the Easy Store extension until a patch is released.
- ›Restrict access to the site or block the vulnerable endpoints.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources