Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-90902
joomshaper.com Easy Store extension for Joomla — Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV
N L N H N H H H 8.6 .0028 18.6 —
AFFECTED
Product Versions Fixed
Easy Store extension for Joomla 1.0.0-3.0.0 – —
TIMELINE
Sep 14 Reserved by Joomla
Sep 23 Published (CNA: Joomla)
Sep 25 RESCORED — CVE-2026-90902 (joomshaper.com Easy Store extension for Joomla). CVSS 8.2 → 8.6 (NVD).
Description
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 - The coupon bulk update task (administrator/index.php?option=com_easystore&task=coupon.couponBulkUpdate) took input IDs and directly concatenated them into raw SQL IN (...) clauses in ProductCoupon.php and CouponsModel.php without sanitization or parameterization. An authenticated administrator could manipulate the query through injected SQL syntax. Resolved by strictly casting all IDs to integers (array_map('intval', ...)) and adopting parameterized ->whereIn() query construction.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| September 14, 2026 | Reserved | Reserved by Joomla |
| September 23, 2026 | Published | Published (CNA: Joomla) |
| September 25, 2026 | RESCORED | RESCORED — CVE-2026-90902 (joomshaper.com Easy Store extension for Joomla). CVSS 8.2 → 8.6 (NVD). |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| joomshaper.com | Easy Store extension for Joomla | — | 1.0.0-3.0.0 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-90902 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
