CVE-2026-90901: Joomla Easy Store SQL Injection Vulnerability

CVE-2026-90901 Overview

CVE-2026-90901 is a high-severity information disclosure vulnerability in the JoomShaper EasyStore extension for Joomla, affecting versions 1.0.0 through 3.0.0. The checkout.searchGuestUser endpoint returned full guest customer records from the #__easystore_guests table when supplied with an email address. The endpoint enforced no authentication, session validation, or ownership checks. Attackers can iterate email lists to enumerate guest customers and harvest Personally Identifiable Information (PII), including full name, phone number, street address, city, postal code, and country.

Critical Impact
Unauthenticated attackers can harvest sensitive customer PII from any Joomla site running vulnerable EasyStore versions by submitting email queries to a public endpoint.

Affected Products

JoomShaper EasyStore extension for Joomla, version 1.0.0
JoomShaper EasyStore extension for Joomla, versions 2.x
JoomShaper EasyStore extension for Joomla, version 3.0.0

Discovery Timeline

2026-09-23 - CVE-2026-90901 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-90901

Vulnerability Analysis

The vulnerability resides in the EasyStore checkout module's guest lookup functionality. The checkout.searchGuestUser endpoint accepted an email parameter and returned complete shipping records from the #__easystore_guests database table. The server-side handler skipped authentication, session validation, and ownership verification before returning the record.

This design allowed any remote client to submit arbitrary email addresses and receive matching guest checkout details. The endpoint effectively acted as a PII lookup API exposed on the public web. The CWE-74 classification reflects improper neutralization within a downstream component, in this case the query executed against the guest table without access control.

While the NVD entry frames the issue with SQL injection language, the vendor description confirms the practical impact is bulk enumeration of guest customer records. Harvested data supports downstream phishing, account takeover attempts, and identity fraud campaigns targeting the affected merchants' customers.

Root Cause

The root cause is a missing authorization check on a sensitive data endpoint. The developer implemented autofill convenience for returning guest shoppers by exposing a server-side lookup, but did not gate the response on prior possession of the record. Any caller supplying an email received the associated PII directly.

Attack Vector

An attacker sends HTTP requests to the checkout.searchGuestUser endpoint on a target Joomla site running EasyStore. Each request contains a candidate email address. The server responds with full guest checkout details when a match exists. Attackers automate this process against email breach corpora to enumerate customers at scale.

The vulnerability requires no credentials, no user interaction, and no chained exploit. Refer to the JoomShaper EasyStore product page for extension details.

Detection Methods for CVE-2026-90901

Indicators of Compromise

High-volume HTTP requests to endpoints containing checkout.searchGuestUser or option=com_easystore with a task parameter referencing guest search.
Requests iterating through many distinct email address values from a single source IP or small IP pool within a short time window.
Successful HTTP 200 responses containing JSON fields such as full_name, phone, street, postal_code, or country returned from checkout endpoints.
Web server access logs showing sequential requests differing only by the email query parameter.

Detection Strategies

Deploy web application firewall (WAF) rules that flag repeated requests to EasyStore checkout endpoints with varying email parameters.
Correlate outbound response sizes on the guest lookup endpoint against a baseline to identify data extraction attempts.
Alert on any single client IP querying the endpoint more than a threshold rate per minute.

Monitoring Recommendations

Enable verbose logging on Joomla com_easystore endpoints and forward logs to a central analytics platform.
Track unique email addresses queried per source IP over rolling time windows.
Monitor the #__easystore_guests table access patterns through database audit logging where supported.

How to Mitigate CVE-2026-90901

Immediate Actions Required

Upgrade the EasyStore extension to the fixed release that removes the unauthenticated guest lookup endpoint.
Audit web server access logs for prior exploitation attempts against checkout.searchGuestUser.
Notify affected customers if log analysis indicates their records were queried by untrusted sources.
Rotate any secondary credentials or tokens that reused the exposed PII as knowledge-based verification.

Patch Information

The vendor resolved the issue by removing the unauthenticated server-side guest lookup endpoint entirely. Autofill functionality was migrated to client-side localStorage gated by explicit user consent. Site administrators must update EasyStore to a release later than 3.0.0 that contains this remediation. Consult the JoomShaper EasyStore page for current release information.

Workarounds

Block requests to the checkout.searchGuestUser endpoint at the WAF or reverse proxy layer until the patch is applied.
Disable the guest checkout feature within EasyStore configuration if the site does not require it.
Restrict access to com_easystore administrative and checkout endpoints by source IP where feasible.

bash

# Example nginx rule to block the vulnerable endpoint
location ~* "option=com_easystore" {
    if ($arg_task ~* "searchGuestUser") {
        return 403;
    }
}