CVE-2026-90900 Overview
CVE-2026-90900 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the JoomShaper Easy Store extension for Joomla, versions 1.0.0 through 3.0.0. The product review submission endpoint index.php?option=com_easystore&task=product.addReview accepted requests without validating an anti-CSRF token. The token check had been commented out in the ProductController code. Attackers can trick authenticated storefront users into submitting unauthorized reviews or review spam through cross-site requests.
Critical Impact
Authenticated Joomla users visiting an attacker-controlled page can be forced to submit arbitrary product reviews, enabling review manipulation and content spam against affected storefronts.
Affected Products
- JoomShaper Easy Store extension for Joomla, versions 1.0.0 through 3.0.0
- Joomla storefronts using the com_easystore component
- Sites exposing the product.addReview task endpoint
Discovery Timeline
- 2026-09-23 - CVE-2026-90900 published to the National Vulnerability Database
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-90900
Vulnerability Analysis
The Easy Store extension exposes a product review submission endpoint through the Joomla component router. The endpoint dispatches to the addReview task within ProductController. In vulnerable builds, the Joomla session token validation call was present in source but commented out, disabling CSRF protection on state-changing review submissions.
Because the endpoint mutates content on behalf of the authenticated session, any origin can craft an HTML form or JavaScript request that submits reviews when the target user visits an attacker page. The impact is limited to integrity of storefront review content. There is no direct confidentiality or availability impact, and no privilege escalation.
Root Cause
The root cause is missing CSRF token verification on a state-changing request handler. Joomla's Session::checkToken('request') or Session::checkToken('post') calls were commented out inside ProductController, and the review form template did not emit a token via HTMLHelper::_('form.token'). The review-form.js client script also did not append a session token to the outgoing payload.
Attack Vector
Exploitation requires an authenticated storefront user to load attacker-controlled content while logged into the target Joomla site. The attacker hosts a page that issues a cross-origin POST to index.php?option=com_easystore&task=product.addReview with review fields. The victim's browser attaches the session cookie, and the server processes the review as if the user submitted it. User interaction is required, but no attacker credentials or privileges on the target site are needed.
No public proof-of-concept or exploit code is currently listed for this CVE. See the JoomShaper EasyStore product page for component context.
Detection Methods for CVE-2026-90900
Indicators of Compromise
- Review submissions in com_easystore tables originating from HTTP requests whose Referer or Origin header does not match the site's own domain.
- Bursts of reviews from a single authenticated user account within a short timeframe.
- POST requests to index.php?option=com_easystore&task=product.addReview lacking the Joomla form token parameter.
Detection Strategies
- Enable web server access logging for the com_easystore component and alert on task=product.addReview POSTs with mismatched or missing Origin/Referer headers.
- Review Joomla database entries for reviews created without the expected form token field in request logs.
- Correlate authentication session identifiers with review creation events to identify anomalous cross-site submission patterns.
Monitoring Recommendations
- Forward Joomla and web server access logs to a centralized log platform and alert on abnormal review submission rates per user.
- Monitor for HTTP requests targeting Easy Store endpoints where the client Origin header is external to the storefront domain.
- Track failed and successful Session::checkToken outcomes after patching to confirm CSRF protection is engaged.
How to Mitigate CVE-2026-90900
Immediate Actions Required
- Upgrade the Easy Store extension to a version later than 3.0.0 that enforces Session::checkToken on the review submission handler.
- Audit ProductController in any custom or forked builds to confirm the CSRF token check is not commented out.
- Review historical review data for suspicious entries submitted during the exposure window and remove spam content.
Patch Information
The vendor resolved CVE-2026-90900 by enforcing Session::checkToken('request') and Session::checkToken('post') inside ProductController, injecting HTMLHelper::_('form.token') into the review form template, and appending the session token to the submission payload in review-form.js. Administrators should apply the vendor update through the Joomla Extension Manager. Refer to the JoomShaper EasyStore product page for release information.
Workarounds
- Temporarily disable the product review feature in the Easy Store configuration until the patched version is installed.
- Deploy a web application firewall rule that blocks POST requests to task=product.addReview when the Origin or Referer header is external.
- Restrict access to storefront review submission for anonymous or newly registered accounts through Joomla's user group access controls.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
