CVE-2026-90901
Description
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest checkout records solely by supplying an email address. The server returned complete shipping details (full name, phone number, street address, city, postal code, and country) directly from the #__easystore_guests table with no authentication, session validation, or ownership checks. An unauthenticated attacker could iterate through email lists to enumerate guest customers and harvest sensitive Personally Identifiable Information (PII). Resolved by removing the unauthenticated server-side guest lookup endpoint entirely and migrating autofill functionality to client-side localStorage protected by explicit user consent.
Is your site exposed to CVE-2026-90901?
Run a free security scan — no signup, results in seconds.
Weakness Type (CWE)
References
Other References
Frequently Asked Questions
What is CVE-2026-90901? +
How do I check if I'm vulnerable to CVE-2026-90901? +
Related Vulnerabilities
Froxlor is open source server administration software. In version 2.3.6 and earlier, the LOC record regex uses `\s+` which matches …
Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote …
Integrated Scripting is a tool for creating scripts for handling complex operations in Integrated Dynamics. Minecraft users who use Integrated …
Vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid.This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1; Parsoid: before 0.16.5, 0.19.2, 0.20.2.
Host Header Injection (HHI) vulnerability in the Hotspot Shield VPN client, which can induce unexpected behaviour when accessing third-party web …
Securing externally available CAN wires can easily allow physical access to the CAN bus, allowing possible injection of specially formed …