The vulnerability lies in the Easy Store extension’s administrator API controller, which only validates CSRF tokens for the products() action. All other administrative AJAX endpoints – orders, coupons, media, customers, settings, tags, categories, reviews and collections – accept state‑changing requests without verifying anti‑CSRF tokens, constituting a cross‑site request forgery flaw (CWE‑352). An attacker who can entice a logged‑in administrator to visit a malicious page or otherwise trigger these endpoints could cause unauthorized modifications across the store backend.

The issue affects the Joomla extension Easy Store from joomshaper.com, versions 1.0.0 through 3.0.0. Any installation of that extension within this range is impacted.

The CVSS score of 7.2 indicates a high severity. Because the attack requires a legitimate administrator session, the vector is web‑based and relies on privileged authenticated access. No EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog. Given the lack of proper CSRF checks, an attacker can easily craft requests that the server will process as if they originated from the administrator, enabling privilege escalation within the store backend.