The Easy Store extension for Joomla exposes sensitive customer information through an IDOR flaw in the checkout.searchGuestUser endpoint. By supplying any email address, an unauthenticated user can retrieve full shipping details, including name, phone number, street address, city, postal code, and country, from the #__easystore_guests database table. This lack of authentication, session validation or ownership checks means attackers can enumerate guest shoppers and harvest personally identifiable information. The vulnerability is a classic information exposure and IDOR weakness, reflected by CWE‑200 and CWE‑639. The compromised data could facilitate phishing, fraud or location‑based attacks against customer base.

The issue affects the joomshaper.com Easy Store extension for Joomla, versions 1.0.0 through 3.0.0. Any Joomla site that has installed this extension during that version range is potentially vulnerable. The flaw specifically targets the front‑end guest checkout functionality exposed by the extension's API endpoint.

With a CVSS score of 8.2 the flaw is considered High severity, and the lack of authentication or isolation makes exploitation trivial once the endpoint is known. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, which suggests no confirmed large‑scale exploitation yet. Attackers can exploit this vulnerability simply by sending HTTP requests to the checkout.searchGuestUser URL with any email address and obtaining the response body, thereby enumerating guests without credential or session data.