CVE-2026-65759 Details
Description
Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 - Critical order and payment information, including states, are processed from client side input, enabling unauthenticated attackers to manipulate payment and order states of arbritrary orders.
A critical vulnerability has been identified in the Easy Store extension for Joomla, versions 1.0.0 through 2.0.1. This vulnerability allows unauthenticated attackers to manipulate payment and order states of arbitrary orders by exploiting a lack of proper validation on client-side input. The issue arises from the way critical order and payment information is processed, enabling attackers to forge payment confirmations and alter order details without any authentication.
Users are advised to update to Easy Store version 2.0.2, which addresses this vulnerability. After updating, it is recommended to clear Joomla's cache and any CDN or page cache.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 23, 2026CISA-ADP
Assessed Jul 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://mysites.guru/blog/easystore-security-disclosure/ | [email protected] | AdvisoryBundleRemedy |
| https://www.joomshaper.com/easystore | [email protected] | ProductVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| JoomShaper EasyStore | <= 2.0.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Modified | CISA-ADP |
| Jul 23, 2026 | New CVE Received | [email protected] |