Vulnerability · Published Jul 23, 2026 · Assigned by Joomla

CVE-2026-65761Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1

Critical 9.3

In plain English

A critical-severity SQL injection in Easy Store extension for Joomla from joomshaper.com. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)1.0%top 35.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling2Nuclei, Public PoC

Official description

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated SQL injection in easystore, allowing full DB read access including credentials and sessions.

Affected products (as reported)

Vendor	Product	Versions
joomshaper.com	Easy Store extension for Joomla	1.0.0-2.0.1

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.joomshaper.com/easystore product
https://mysites.guru/blog/easystore-security-disclosure/ third-party-advisory