CVE-2026-90900: Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0
Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The product review submission endpoint (index.php?option=comeasystore&task=product.addReview) accepted submissions without verifying an anti-CSRF token (the check had been commented out in code). An attacker could trick a logged-in user into posting unauthorized reviews or submitting review spam via cross-site requests. Resolved by enforcing Session::checkToken('request') / Session::checkToken('post') in ProductController, injecting HTMLHelper::('form.token') into the review form template, and appending the session token to the submission payload in review-form.js.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In Easy Store's ProductController, enforce Session::checkToken('request') or Session::checkToken('post') for product review submissions; add HTMLHelper::_('form.token') to the review form template and append the session token to the submission payload in review-form.js.
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Sites using Easy Store versions 1.0.0 through 3.0.0 are exposed when a user is logged in and can submit product reviews. An attacker must be able to induce that logged-in user’s browser to send a cross-site request to the product review submission endpoint.
What could an attacker do without directly accessing an account?
They could cause a logged-in user’s browser to submit unauthorized product reviews or review spam. The issue affects the product.addReview endpoint because it accepted requests without validating an anti-CSRF token.
How was the issue resolved?
The fix enforces Session::checkToken('request') or Session::checkToken('post') in ProductController, adds a form token to the review form template, and includes the session token in the review submission payload.