CVE-2026-90899: Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0
Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest checkout records solely by supplying an email address. The server returned complete shipping details (full name, phone number, street address, city, postal code, and country) directly from the #easystoreguests table with no authentication, session validation, or ownership checks. An unauthenticated attacker could iterate through email lists to enumerate guest customers and harvest sensitive Personally Identifiable Information (PII). Resolved by removing the unauthenticated server-side guest lookup endpoint entirely and migrating autofill functionality to client-side localStorage protected by explicit user consent.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove the affected component from your environment.
Remove the unauthenticated server-side guest lookup endpoint used by the Easy Store guest checkout.
- Configuration
Migrate guest checkout autofill functionality to client-side localStorage and require explicit user consent.
Easy Store guest checkout autofill autofill data storage and consent = client-side localStorage with explicit user consent
Event History
Frequently Asked Questions
Who is exposed to this issue?
Guest checkout customers whose records are stored in the #__easystore_guests table are exposed. Their full name, phone number, street address, city, postal code, and country could be returned when an attacker supplies their email address.
What does an attacker need to exploit it?
An attacker does not need authentication, a valid session, or ownership of the guest record. They only need an email address to query the checkout.searchGuestUser endpoint and can iterate through email lists to enumerate records.
Are affected deployments vulnerable by default?
The affected Easy Store versions are 1.0.0 through 3.0.0. In those versions, the endpoint lacked authentication, session validation, and ownership checks.
What should be done if patching cannot happen immediately?
The vulnerable unauthenticated server-side guest lookup endpoint should be removed or otherwise disabled. The resolution replaces its autofill behavior with client-side localStorage protected by explicit user consent.