External risk intelligence

Joomla Easy Store Information Disclosure Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-65760

The vulnerability exists in a Joomla e-commerce extension. Such extensions are commonly deployed as part of public-facing web applications to handle customer orders and store data, making the vulnerable functionality directly accessible to users over the public internet.

Information Disclosure

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability in a popular Joomla e-commerce extension allows any logged-in user to view the order and personal information of any other customer. The issue stems from improper access checks within the extension, meaning that access controls designed to protect sensitive data are not functioning as intended, potentially exposing customer data across different users.

Sensitive customer data can be exposed.
It affects e-commerce operations and customer trust.
Confirm extension relevance and exposure to customer data.

Attack Path

How an attacker could exploit the issue

Attackers can access sensitive customer and order data by exploiting a flaw in an e-commerce extension for Joomla. This vulnerability allows any user who is logged into the system to view information about any order, not just their own.

No specific user access needed to view data.
Vulnerable component: Easy Store extension.
Risk: Disclosure of order and customer data.

Live Threat

Current exploitation, exposure, and threat context

Logged-in users of the Easy Store Joomla extension could retrieve order and customer information for any order within the system. This exposure is possible due to improper access checks when the extension is deployed.

Customer orders and personal information at risk.
Access via improper checks in the extension.
Unauthorized data retrieval by users.

Operational Fix

Recommended remediation, mitigation, and detection steps

The primary responsibility for addressing this vulnerability likely falls on the application owners and platform teams managing the Joomla website, with support from the security team. The immediate first step is to identify all instances of the affected extension, confirm their exposure and business criticality, and then work with the vendor or internal resources to plan a remediation strategy based on risk.

Application owners should manage this issue.
Verify affected extension presence and exposure.
Plan remediation with vendor or internal teams.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Easy Store extension for Joomla?

Easy Store is an e-commerce extension developed by JoomShaper used to manage online shops within the Joomla content management system. It provides tools for handling product listings, shopping carts, and customer order processing. By adding this extension, site administrators transform their Joomla sites into fully functional digital storefronts.

What does CWE-284 mean for CVE-2026-65760?

This CVE involves a vulnerability classified as CWE-284, or Improper Access Control. In plain terms, the software fails to verify if a user has the proper permissions before granting access to data. Because the system does not check identity correctly, it allows users to view information they are not authorized to see, such as the order history and personal details of other customers.

How does an attacker trigger this vulnerability?

The flaw is triggered when a user is logged into the system and requests order information. The extension fails to validate if the requester owns the specific order they are trying to view. Importantly, this does not require administrative privileges or special bypass techniques; simply being a registered user with a standard account is sufficient to access data belonging to other customers.

Is my site at risk if it uses Easy Store?

According to Halo Surface Signal, this vulnerability is highly relevant because Easy Store is typically installed on public-facing websites to enable e-commerce. Because these sites must be accessible over the internet to process orders, the vulnerable functionality is inherently exposed to any logged-in user, making it critical for administrators to assess their specific implementation.

What should I do if I use this extension?

Your first step is to identify all Joomla installations where Easy Store versions 1.0.0 through 2.0.1 are currently active. Once identified, evaluate the impact on your customer data. Immediately coordinate with your web management team to determine if a vendor patch is available or if you need to disable the extension's online ordering features until the access control flaws can be remediated.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.