The Easy Store extension for Joomla contains a media deletion endpoint that accepts an 'ids' parameter. The code concatenates these values directly into a raw SQL IN clause without integer casting or parameterisation. An authenticated administrator, or an attacker who gains access to an admin session, can inject arbitrary SQL commands, allowing read, write or delete operations on the Joomla database. This is a classic example of SQL injection (CWE-89).

Easy Store extension versions 1.0.0 through 3.0.0 for Joomla, delivered by joomshaper.com, are vulnerable when the media image deletion endpoint is available to an authenticated user.

The CVSS score of 8.6 indicates a high severity issue. The EPSS score of < 1% suggests low current exploitation likelihood, and it is not yet listed in the CISA KEV catalog. The attack requires an authenticated administrator session, giving the attacker privileged access. Once authenticated, the attacker can execute arbitrary SQL statements, leading to potential data exfiltration, tampering or destruction. Prompt remediation is recommended despite the low exploitation probability due to the high potential impact.