An unauthenticated information disclosure vulnerability in the Easy Store extension for Joomla allows remote attackers to harvest sensitive customer shipping data.

This vulnerability involves an improper neutralization of special elements in a database query, specifically within the checkout.searchGuestUser endpoint. Although the title references SQL injection, the primary impact is an unauthenticated data exposure flaw where the application fails to perform session validation or ownership checks, allowing any remote user to query the guest database.

The successful exploitation of this vulnerability results in the unauthorized exfiltration of sensitive Personally Identifiable Information, including customer full names, phone numbers, and physical addresses. With a CVSS score of 8.6, this flaw presents a high risk of regulatory noncompliance, potential data breach notification requirements, and significant reputational damage to the organization.

Immediate Action: Contact the vendor, JoomShaper, to obtain and apply the latest security update that removes the vulnerable endpoint entirely.

Proactive Monitoring: Monitor web server access logs for repeated, high-frequency requests to the checkout.searchGuestUser endpoint or anomalous traffic patterns originating from single IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules to block or rate-limit all traffic directed at the checkout.searchGuestUser endpoint until the official patch is applied.

Public Exploit Available: Unknown

Given the severity of this PII exposure, organizations currently utilizing the Easy Store extension must prioritize the removal of the vulnerable endpoint. If an immediate update is not available from JoomShaper, administrators should disable the affected functionality or restrict access to the checkout process until a vendor-supplied fix is verified and deployed.