The Easy Store extension for Joomla versions 1.0.0 to 2.0.1 suffers from an improper access control vulnerability (CWE-284) that permits authenticated users to access order and personal information of other customers. This results in unauthorized disclosure of sensitive data (CWE-200). The vulnerability is exploitable remotely without privileges or user interaction, as indicated by the CVSS 4.0 vector. The issue is due to missing or insufficient access checks in the extension's order retrieval functionality. No vendor advisory or patch has been published yet, and the vulnerability remains unmitigated.

Exploitation of this vulnerability allows any authenticated user to access sensitive order and personal information of other customers within the Easy Store extension. This can lead to privacy violations, data leakage, and potential further attacks leveraging exposed customer data. The critical CVSS score reflects the high confidentiality impact and ease of exploitation without privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict access to the Easy Store extension to trusted users only and monitor for suspicious activity. Avoid granting unnecessary login permissions to untrusted users. Follow vendor communications closely for updates on official patches or mitigations.