CVE-2026-65759 is an improper access control vulnerability in the Easy Store extension for Joomla (versions 1.0.0 to 2.0.1). The extension processes critical order and payment information, including states, from client-side input without proper validation or authentication. This enables unauthenticated attackers to forge payment and order states arbitrarily, potentially compromising order integrity and payment processes. The CVSS 4.0 base score is 8.7 (high severity) with network attack vector, no privileges required, no user interaction, and high impact on integrity.

An unauthenticated attacker can manipulate payment and order states of arbitrary orders by exploiting the improper access control vulnerability. This can lead to unauthorized changes in order processing and payment status, potentially causing financial and operational disruptions for affected Joomla sites using the Easy Store extension.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the Easy Store extension or implementing compensating controls to validate order and payment states server-side.