Description
Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The product review submission endpoint (index.php?option=com_easystore&task=product.addReview) accepted submissions without verifying an anti-CSRF token (the check had been commented out in code). An attacker could trick a logged-in user into posting unauthorized reviews or submitting review spam via cross-site requests. Resolved by enforcing Session::checkToken('request') / Session::checkToken('post') in ProductController, injecting HTMLHelper::_('form.token') into the review form template, and appending the session token to the submission payload in review-form.js.
Published: 2026-09-23
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Unauthorized review posting via CSRF
Action: Immediate Patch
AI Analysis

Impact

The Easy Store extension for Joomla lacks CSRF token verification on the product review submission endpoint. This missing check allows an attacker to trick an authenticated user into submitting arbitrary reviews or spam by sending requests from another site. The flaw is a classic cross‑site request forgery (CWE‑352) that can enable defamation or manipulation of product reputation without the victim’s knowledge.

Affected Systems

The vulnerability affects the Easy Store extension from joomshaper.com, versions 1.0.0 through 3.0.0, which is a popular Joomla extension for storefront product reviews.

Risk and Exploitability

With a CVSS score of 5.3 the issue is considered medium severity. No EPSS score is available and it is not listed in CISA’s KEV catalog. The attack vector is client‑side browser interaction; an attacker must have the target logged in and can exploit the flaw by causing a cross‑site request to the review endpoint. The exploitation does not grant code execution but can corrupt review data and damage reputation.

Generated by OpenCVE AI on September 23, 2026 at 19:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest official Easy Store update that restores CSRF token verification.
  • Ensure that the review form template includes HTMLHelper::_('form.token') to generate a token and that the token is sent with the request payload.
  • Modify the ProductController to enforce Session::checkToken('request') or Session::checkToken('post') before accepting review submissions.

Generated by OpenCVE AI on September 23, 2026 at 19:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://www.joomshaper.com/easystore cve-icon cve-icon
History

Wed, 23 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Joomshaper.com
Joomshaper.com easy Store Extension For Joomla
Vendors & Products Joomshaper.com
Joomshaper.com easy Store Extension For Joomla

Wed, 23 Sep 2026 18:45:00 +0000

Type Values Removed Values Added
Description Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The product review submission endpoint (index.php?option=com_easystore&task=product.addReview) accepted submissions without verifying an anti-CSRF token (the check had been commented out in code). An attacker could trick a logged-in user into posting unauthorized reviews or submitting review spam via cross-site requests. Resolved by enforcing Session::checkToken('request') / Session::checkToken('post') in ProductController, injecting HTMLHelper::_('form.token') into the review form template, and appending the session token to the submission payload in review-form.js.
Title Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0
Weaknesses CWE-352
References
Metrics cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Joomshaper.com Easy Store Extension For Joomla
cve-icon MITRE

Status: PUBLISHED

Assigner: Joomla

Published:

Updated: 2026-09-23T19:32:42.318Z

Reserved: 2026-09-14T10:23:04.450Z

Link: CVE-2026-90900

cve-icon Vulnrichment

Updated: 2026-09-23T19:32:39.735Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-23T19:19:43.020

Modified: 2026-09-23T20:17:21.103

Link: CVE-2026-90900

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T19:45:08Z

Weaknesses
  • CWE-352

    Cross-Site Request Forgery (CSRF)