SQL Injection in Joomshaper.com Easy Store Extension For Joomla
CVE-2026-65761
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated SQL injection in easystore, allowing full DB read access including credentials and sessions.
Vulnerability class: SQL Injection
Published · last modified .
EPSS exploit prediction
EPSS: 0.010 (64.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 64th percentile — 64.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: 0.000
Affected products
- Joomshaper.com Easy Store Extension For Joomla — versions 1.0.0-2.0.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.joomshaper.com/easystore (product)
- mysites.guru/blog/easystore-security-disclosure/ (third-party-advisory)
Frequently asked questions
- What is CVE-2026-65761?
- CVE-2026-65761 is a vulnerability in Joomshaper.com Easy Store Extension For Joomla, classified under SQL Injection. Published 2026-07-23.
- Is CVE-2026-65761 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.