High severity · published Jul 23, 2026
CVE-2026-65759
Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1
8.7
CVSS
0.4%
EPSS
No
On KEV
Description
Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 - Critical order and payment information, including states, are processed from client side input, enabling unauthenticated attackers to manipulate payment and order states of arbritrary orders.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
Easy Store extension for Joomla · joomshaper.com
1.0.0-2.0.1 · source: vendor
Affected product
ES
Easy Store extension for Joomla
joomshaper.com
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-65759
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-65759
mysites.guru
https://mysites.guru/blog/easystore-security-disclosure/
www.joomshaper.com
https://www.joomshaper.com/easystore
More from Easy Store extension for Joomla
9.3
CVE-2026-65761
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1
9.2
CVE-2026-65760
Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1
8.6
CVE-2026-90901
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0
8.6
CVE-2026-90902
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0
8.6
CVE-2026-90904
Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0