CVE-2026-90901 joomshaper.com CVE debrief

Who should care

Joomla administrators and defenders should verify and remediate this vulnerability as it poses a high risk of data breaches, session compromise, and privilege escalation. The vulnerability allows authenticated administrators or attackers to inject arbitrary SQL statements, potentially leading to significant operational impacts. Immediate verification and remediation are crucial to mitigate this vulnerability effectively. This vulnerability affects Joomla

Why it matters

This SQL injection vulnerability in the Easy Store extension for Joomla allows authenticated administrators or attackers to inject arbitrary SQL statements, potentially leading to data breaches, session compromise, and privilege elevation.

• Potential data breaches due to arbitrary SQL injection
• Compromise of Joomla administrator sessions
• Elevation of privileges for attackers

Technical summary

The media deletion endpoint in Easy Store extension for Joomla is vulnerable to SQL injection due to improper handling of the 'ids' parameter. An authenticated administrator or attacker with access to an admin session could inject arbitrary SQL statements, potentially leading to data breaches, session compromise, and privilege elevation. The vulnerability exists in Media.php and MediaModel.php, where the 'ids' parameter is directly imploded into raw SQL IN (...) clauses without integer casting or parameterization. This vulnerability affects Easy Store extension versions 1.0.0-3.0.0, and

Defensive priority

High priority for Joomla administrators and defenders to verify and remediate

Recommended defensive actions

• Verify and apply vendor patches for Easy Store extension versions 1.0.0-3.0.0
• Restrict access to the media deletion endpoint
• Monitor for suspicious SQL queries
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The media deletion endpoint in Easy Store extension for Joomla is vulnerable to SQL injection. An authenticated administrator or attacker with access to an admin session could inject arbitrary SQL statements.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.