CVE-2026-90903: Joomla Easy Store CSRF Vulnerability

CVE-2026-90903 Overview

CVE-2026-90903 is a Cross-Site Request Forgery (CSRF) vulnerability in the JoomShaper Easy Store extension for Joomla, affecting versions 1.0.0 through 3.0.0. The administrator ApiController verified anti-CSRF tokens only inside the products() action. All other administrative AJAX endpoints accepted state-changing requests without any token check. An attacker can trick a logged-in administrator into submitting forged requests that modify orders, coupons, media, customers, settings, tags, categories, reviews, and collections in the store backend.

Critical Impact
A single crafted link or page visited by an authenticated administrator can trigger unauthorized changes across nearly every Easy Store backend resource, compromising store integrity and availability.

Affected Products

JoomShaper Easy Store extension for Joomla, version 1.0.0
JoomShaper Easy Store extension for Joomla, versions 2.x
JoomShaper Easy Store extension for Joomla, up to and including 3.0.0

Discovery Timeline

2026-09-23 - CVE-2026-90903 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-90903

Vulnerability Analysis

The Easy Store administrator API exposes multiple AJAX endpoints through a single ApiController class. The controller dispatches requests to handlers such as orders(), coupons(), media(), customers(), settings(), tags(), categories(), reviews(), and collections(). Only the products() handler invoked Session::checkToken() before performing state-changing operations.

Because the token check lived inside a single handler rather than the dispatcher, every other endpoint processed POST, PUT, PATCH, and DELETE requests based solely on the administrator's session cookie. Browsers automatically attach that cookie to cross-origin requests, which is the precondition CSRF attacks depend on [CWE-352].

An attacker hosts a page that submits forged requests to the vulnerable endpoints. When a logged-in Joomla administrator visits the page, the browser replays their authenticated session against the store backend and executes the attacker's chosen operations.

Root Cause

The root cause is missing global CSRF verification in ApiController::execute(). Token validation was implemented per action rather than at the dispatch layer, and only one action received the check. Any endpoint added without an explicit Session::checkToken() call inherited the vulnerable default.

Attack Vector

Exploitation requires an authenticated Joomla administrator to interact with attacker-controlled content, such as visiting a malicious page or clicking a crafted link. No credentials or elevated privileges are required from the attacker. Successful requests can create, modify, or delete orders, coupons, customers, media, product taxonomies, reviews, collections, and store settings.

No verified public proof-of-concept code is available. See the JoomShaper EasyStore product page for vendor context.

Detection Methods for CVE-2026-90903

Indicators of Compromise

Administrator AJAX requests to Easy Store endpoints (orders, coupons, media, customers, settings, tags, categories, reviews, collections) with a missing, empty, or invalid Joomla anti-CSRF token parameter.
HTTP Referer or Origin headers on state-changing Easy Store API requests pointing to domains outside the Joomla administrator host.
Unexpected changes to store settings, coupon codes, order status, or customer records that do not correlate with authorized administrator activity in Joomla audit logs.

Detection Strategies

Enable web server access logging for /administrator/ paths and alert on POST, PUT, PATCH, or DELETE requests to Easy Store API routes lacking a valid token parameter.
Correlate Joomla user session activity with source IP and User-Agent to identify state-changing requests originating from unusual browsing contexts.
Deploy a web application firewall rule that inspects cross-origin requests against Joomla administrator endpoints and blocks those without matching Origin or Referer values.

Monitoring Recommendations

Forward Joomla and web server logs to a centralized SIEM and build dashboards for administrator API activity volume and error rates.
Track privileged administrator sessions and alert when high-impact resources such as settings or coupons are modified outside change windows.
Monitor outbound email and store notifications for evidence of unauthorized coupon issuance, order refunds, or account changes.

How to Mitigate CVE-2026-90903

Immediate Actions Required

Upgrade the Easy Store extension to a release later than 3.0.0 that implements global CSRF verification in ApiController::execute().
Force administrator re-authentication and invalidate active sessions after upgrading to reduce the window for in-flight abuse.
Review Easy Store data (orders, coupons, customers, settings) for unauthorized modifications made prior to remediation.

Patch Information

The vendor resolved the issue by adding global CSRF verification in ApiController::execute() for all state-changing HTTP methods (POST, PUT, PATCH, DELETE) using Session::checkToken(). Administrators should apply the vendor-provided update through the Joomla extension manager. Refer to the JoomShaper EasyStore product page for release information.

Workarounds

Restrict access to the Joomla /administrator/ path by source IP address or VPN until the extension is upgraded.
Require administrators to use a dedicated browser or browser profile with no unrelated tabs open while managing the store.
Configure a web application firewall to reject requests to Easy Store administrator API endpoints when the Origin or Referer header does not match the Joomla site.

bash

# Example WAF rule concept: block cross-origin state-changing requests
# to Easy Store admin API endpoints (pseudocode)
if request.path matches "^/administrator/.*easystore.*"
   and request.method in ["POST","PUT","PATCH","DELETE"]
   and request.header.Origin not in ["https://your-joomla-site.example"]:
    action: block
    log: "CVE-2026-90903 CSRF attempt"