The vulnerability is an authenticated, privileged SQL injection in the Easy Store Joomla extension, where the coupon bulk update task directly concatenates administrator supplied coupon IDs into raw SQL IN clauses without sanitization or parameterization. An administrator can inject SQL statements, potentially gaining read or write access to the database, modifying coupon data, or escalating privileges. This weakness corresponds to CWE-74, representing improper handling of client input in SQL queries.

Affected: the Easy Store extension for Joomla published by joomshaper.com, versions 1.0.0 through 3.0.0. All installations of these versions that allow administrator‑level access to the coupon bulk update functionality are vulnerable.

The vulnerability has a CVSS score of 8.2, indicating high severity. The EPSS score is not available, but the lack of additional data does not reduce its potential threat. It is not listed in the CISA KEV catalog. Attackers need authenticated access with at least administrative privileges to exploit the flaw, which is a realistic scenario in compromised or mismanaged Joomla sites. Once exploited, an attacker can manipulate the database, potentially impacting confidentiality, integrity, and availability of the store’s data.