Vulnerability Description
Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The product review submission endpoint (index.php?option=com_easystore&task=product.addReview) accepted submissions without verifying an anti-CSRF token (the check had been commented out in code). An attacker could trick a logged-in user into posting unauthorized reviews or submitting review spam via cross-site requests. Resolved by enforcing Session::checkToken('request') / Session::checkToken('post') in ProductController, injecting HTMLHelper::_('form.token') into the review form template, and appending the session token to the submission payload in review-form.js.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-90900?
CVE-2026-90900 is a documented vulnerability. Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The product review submission endpoint (index.php?opti...
How severe is CVE-2026-90900?
CVSS scoring is not yet available for CVE-2026-90900. Check NVD for updates.
Is there a patch for CVE-2026-90900?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.