SQL Injection in Joomshaper.com Easy Store Extension For Joomla

CVE-2026-90901

Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The media deletion endpoint (administrator/index.php?option=com_easystore&task=media.deleteImage) parsed the ids parameter as a comma-separated string and imploded it directly into raw SQL IN (...) clauses in Media.php and MediaModel.php without integer casting or parameterization. An authenticated administrator or attacker with access to an admin session could inject arbitrary SQL statements.

Vulnerability class: SQL Injection

Published · last modified .

EPSS exploit prediction

EPSS: 0.004 (30.8th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 31st percentile — 30.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-90901: held from 0.003 to 0.004.

EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.001

Affected products

Weakness classification (CWE)

References