---
id: CVE-2026-90900
title: >-
  Joomla Extension - joomshaper.com - Missing CSRF Token Verification in
  Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The
  product review submission endpoint
  (index.php?option=com_easystore&task=product.addRevi…
summary: >-
  Joomla Extension - joomshaper.com - Missing CSRF Token Verification in
  Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The
  product review submission endpoint
  (index.php?option=com_easystore&task=product.addRevi…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-352
vendor: joomshaper.com
product: Easy Store extension for Joomla
affected:
  - easy_store_extension_for_joomla 1.0.0-3.0.0
published: '2026-09-23'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T20:17:21.103'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90900'
references:
  - url: 'https://www.joomshaper.com/easystore'
    label: security@joomla.org
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-23T19:32:35.989396Z'
cvssSource: cna
ingestedAt: '2026-09-23T19:31:04.471Z'
epss: 0.00165
epssPercentile: 0.05014
---

## Overview

Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The product review submission endpoint (index.php?option=com_easystore&task=product.addReview) accepted submissions without verifying an anti-CSRF token (the check had been commented out in code). An attacker could trick a logged-in user into posting unauthorized reviews or submitting review spam via cross-site requests. Resolved by enforcing Session::checkToken('request') / Session::checkToken('post') in ProductController, injecting HTMLHelper::_('form.token') into the review form template, and appending the session token to the submission payload in review-form.js.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.