CVE-2026-90899: Joomla Easy Store PII Exposure Vulnerability

CVE-2026-90899 Overview

CVE-2026-90899 is an Insecure Direct Object Reference (IDOR) vulnerability in the JoomShaper Easy Store extension for Joomla, versions 1.0.0 through 3.0.0. The checkout.searchGuestUser endpoint accepted an email address and returned complete guest checkout records from the #__easystore_guests table without authentication, session validation, or ownership checks. An unauthenticated attacker can iterate through email lists to enumerate guest customers and harvest Personally Identifiable Information (PII), including full name, phone number, street address, city, postal code, and country. The issue is classified under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Any unauthenticated attacker with network access to a vulnerable Easy Store installation can harvest guest customer PII at scale by supplying arbitrary email addresses.

Affected Products

JoomShaper Easy Store extension for Joomla, version 1.0.0
JoomShaper Easy Store extension for Joomla, versions 1.0.1 through 2.x
JoomShaper Easy Store extension for Joomla, version 3.0.0

Discovery Timeline

2026-09-23 - CVE-2026-90899 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-90899

Vulnerability Analysis

The vulnerability resides in the checkout.searchGuestUser endpoint exposed by the Easy Store extension. The endpoint was designed to autofill checkout fields for returning guest shoppers. It accepted an email address as its sole input parameter and returned the corresponding record from the #__easystore_guests database table.

The server performed no authentication, no session validation, and no verification that the caller owned the queried email address. Any anonymous client on the internet could invoke the endpoint and receive complete shipping details for any guest who had previously checked out. Response payloads included full name, phone number, street address, city, postal code, and country.

Attackers can automate requests against common email lists or breach corpora to enumerate guest customers across every store running the extension.

Root Cause

The root cause is missing access control on a server-side data lookup. The endpoint treated the supplied email as both the query parameter and the implicit authorization token, without validating that the requester had any relationship to that email address. This is a canonical Insecure Direct Object Reference pattern where the object identifier alone controls access.

Attack Vector

Exploitation requires only network access to the Joomla site running a vulnerable Easy Store version. An attacker sends HTTP requests to the checkout.searchGuestUser endpoint with candidate email addresses. For each address that matches a stored guest record, the server returns the full PII record in the response body. No credentials, cookies, or CSRF tokens are required. The vulnerability is described in prose here because no verified public exploit code is available; see the JoomShaper EasyStore Overview for product context.

Detection Methods for CVE-2026-90899

Indicators of Compromise

Repeated HTTP requests to Joomla index.php routes invoking the checkout.searchGuestUser task or component action with varying email parameters from a single source IP.
High-volume access to the Easy Store checkout component from IPs that never complete a purchase workflow.
Web server access logs showing sequential enumeration patterns against the guest lookup endpoint outside normal shopper session flows.

Detection Strategies

Deploy web application firewall (WAF) rules that rate-limit and alert on requests to option=com_easystore combined with task=checkout.searchGuestUser.
Correlate database query volume against the #__easystore_guests table with source IP distribution to surface enumeration behavior.
Alert on HTTP 200 responses to the guest lookup endpoint from unauthenticated sessions where the response body contains address or phone fields.

Monitoring Recommendations

Enable verbose access logging on the Joomla frontend and forward logs to a centralized analytics platform for retention and search.
Track baseline request rates for Easy Store checkout endpoints and alert on statistical deviations.
Monitor egress data volumes from the web application tier to detect bulk PII harvesting.

How to Mitigate CVE-2026-90899

Immediate Actions Required

Upgrade the Easy Store extension to a version above 3.0.0 that removes the unauthenticated server-side guest lookup endpoint.
Audit web server and application logs for prior invocations of checkout.searchGuestUser and assess whether guest PII was exfiltrated.
Notify affected guest customers in accordance with applicable data breach disclosure regulations if exposure is confirmed.

Patch Information

The vendor resolved the vulnerability by removing the unauthenticated server-side guest lookup endpoint entirely. Autofill functionality was migrated to client-side localStorage gated by explicit user consent, eliminating server-side PII exposure. Administrators should install the fixed release from the JoomShaper EasyStore product page.

Workarounds

Block requests matching task=checkout.searchGuestUser at the WAF or reverse proxy tier until the extension can be updated.
Disable the Easy Store extension in the Joomla administrator interface if patching is not immediately possible.
Restrict access to the checkout component using web server access control lists where feasible for the deployment.

bash

# Example nginx rule to block the vulnerable endpoint until patched
if ($arg_task = "checkout.searchGuestUser") {
    return 403;
}