CVE-2026-65759

Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1

State: Published
Severity: 8.7 High
Published: Jul 23, 2026
Updated: Aug 12, 2026
Reserved: Jul 22, 2026

Description

Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 - Critical order and payment information, including states, are processed from client side input, enabling unauthenticated attackers to manipulate payment and order states of arbritrary orders.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N	Joomla

Weaknesses

CWE-284 Improper Access Control

Affected Products

Product	Versions
Easy Store extension for Joomlajoomshaper.com	1.0.0-2.0.1Affected

References

https://www.joomshaper.com/easystoreproduct
https://mysites.guru/blog/easystore-security-disclosure/third-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.