The JoomOCShop 1.0 extension in Joomla! contains a cross‑site request forgery flaw that permits attackers to perform unauthorized actions on the accounts of users who are already logged in. By crafting malicious HTML forms that target administrative routes such as /joomoc2/?route=account/edit, an attacker can alter account details or reset passwords without the victim’s consent. This vulnerability is a classic CSRF weakness as indicated by CWE‑352, enabling an attacker to exploit an authenticated session to change sensitive data.

The affected system is the Joomla! extension JoomOCShop, specifically version 1.0. No other vendors or products are listed, and the vulnerability is tied to the account‑editing endpoints exposed by the extension.

The assigned CVSS score of 5.3 reflects a moderate risk, with no EPSS data available and the vulnerability not listed in CISA’s KEV catalog. The likely attack vector is a user visiting a malicious page that contains a forged form submitted to the vulnerable account endpoint, exploiting the fact that the user’s browser automatically includes their authenticated session cookie. While the vulnerability requires an active session, an attacker who can obtain such a session, whether through phishing or session hijacking, can perform the harmful actions detailed above.