CVE-2026-90903 Cross-site request forgery in Easy Store extension for Joomla
Attackers can trick administrators into modifying store data via AJAX endpoints lacking CSRF protection in the Joomla Easy Store extension.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-90903?
CVE-2026-90903 is a high-severity vulnerability in joomshaper.com Easy Store extension for Joomla, published on 23 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0 - The administrator ApiController only validated CSRF tokens inside the products() action. All other administrative AJAX endpoints (orders, coupons, media, customers, settings, tags, categories, reviews, and collections) accepted state-changing requests without checking anti-CSRF tokens. An attacker could trick a logged-in administrator into triggering unauthorized state modifications across the store backend. Resolved by implementing global CSRF verification in ApiController::execute() for all state-changing HTTP methods (POST, PUT, PATCH, DELETE) via Session::checkToken().
Weakness: CWE-352
Which versions are affected by CVE-2026-90903?
How do I fix CVE-2026-90903?
No fix has been published for CVE-2026-90903 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-90903 being exploited?
There is no known exploitation of CVE-2026-90903 in the wild and no public exploit code.
Sources
Also known as GHSA-crc8-cwj2-cw39.