An improper access control vulnerability in the JoomShaper Easy Store extension for Joomla creates a high risk of unauthorized data modification.

This vulnerability involves improper access control (CWE-284) within the extension. It allows an unauthenticated remote attacker to bypass security checks and potentially manipulate sensitive store information or configuration settings.

With a CVSS score of 8.7, this flaw represents a significant threat to the integrity of e-commerce operations. An attacker could alter product pricing, inventory data, or store configurations, leading to direct financial loss and severe reputational damage. The ability to perform these actions without authentication exacerbates the risk to all exposed Joomla installations.

Immediate Action: Check the JoomShaper official website for the latest security release and apply the update to the Easy Store extension immediately.

Proactive Monitoring: Monitor Joomla access logs for suspicious administrative requests or unauthorized changes to store-related database tables.

Compensating Controls: Utilize a Web Application Firewall (WAF) to block suspicious requests targeting known Easy Store extension paths and parameters.

Public Exploit Available: Unknown

Given the high CVSS score, organizations using the Easy Store extension must treat this as a priority update. If an official patch is not yet applied, restrict access to the affected extension or disable it until a secure version is deployed to protect store data.