The Easy Store extension for Joomla versions 1.0.0 to 2.0.1 suffers from improper access control (CWE-284) that permits logged-in users to access order and customer information belonging to other users. This vulnerability results in unauthorized disclosure of sensitive personal and order data (CWE-200). The vulnerability is remotely exploitable over the network without user interaction or privileges beyond a valid login. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, high impact on confidentiality, and no impact on integrity or availability. No vendor-provided patch or mitigation is currently documented.

Exploitation of this vulnerability allows any authenticated user to access sensitive order and personal information of other customers in the system, violating confidentiality. This could lead to privacy breaches and potential misuse of customer data. There is no indication of impact on system integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Easy Store extension to trusted users only and monitor for unauthorized access attempts. Avoid exposing the system to untrusted users. Follow vendor channels for updates on patches or official mitigations.