🚨High - EasyStore for Joomla Unauthenticated Payment/Order Forgery (CVE-2026-65759) JoomShaper's EasyStore extension for Joomla (versions 1.0.0 through 2.0.1) processes critical order and payment information, including payment/order states, from client-side input without server-side authorization. An unauthenticated attacker can therefore forge or manipulate the payment and order states of arbitrary orders - for example flipping an unpaid order to paid - resulting in direct financial fraud against the store. It pairs with the unauthenticated SQL injection (CVE-2026-65761) from the same disclosure. CVSS 8.7, integrity impact. 👉Affected: EasyStore 1.0.0-2.0.1. Update to the patched release from JoomShaper; if unavailable, restrict access or take the store offline.
Post summary
The post discloses a high‑severity vulnerability (CVE‑2026‑65759) in JoomShaper's EasyStore plugin that allows unauthenticated attackers to forge payment/order states, and recommends updating to the patched release or disabling the extension.
