CVE-2026-90900

Severity not reported

Data quality: awaiting analysis. NVD has not completed analysis, so CVSS and affected-product data may be missing or change.

Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The product r…

Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The product review submission endpoint (index.php?option=com_easystore&task=product.addReview) accepted submissions without verifying an anti-CSRF token (the check had been commented out in code). An attacker could trick a logged-in user into posting unauthorized reviews or submitting review spam via cross-site requests. Resolved by enforcing Session::checkToken('request') / Session::checkToken('post') in ProductController, injecting HTMLHelper::_('form.token') into the review form template, and appending the session token to the submission payload in review-form.js.

CVSS

—

Awaiting analysis by NVD

Timeline (UTC)

Published: 2026-09-23 19:19

Modified: 2026-09-23 20:17

NVD status: Awaiting Analysis

Last synced 3 days ago

Verified against the source API 2026-10-27 06:55 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

Not reported by the source (unknown — not "none").

Weakness classification (CWE)

CWE-352

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

No vendor advisory or patch reference tagged by NVD. Check the references below.

References

https://www.joomshaper.com/easystore security@joomla.org

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 06:55 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores