CVE-2026-65761 is an SQL injection vulnerability (CWE-89) in the Easy Store extension for Joomla by joomshaper.com. Versions 1.0.0 through 2.0.1 are affected. The flaw arises from improper neutralization of special elements in SQL commands due to insufficient validation of order parameters. This allows unauthenticated attackers to perform SQL injection attacks, enabling full read access to the database, including credentials and session information. No official patch or remediation level has been provided as of the publication date.

Successful exploitation allows unauthenticated attackers to read the entire database contents, including sensitive information such as user credentials and session data. This can lead to account compromise, data leakage, and further system compromise. The vulnerability has a critical severity rating with a CVSS 4.0 score of 9.3, reflecting its high impact and ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected Joomla extension and monitor for suspicious activity. Consider disabling or removing the Easy Store extension if it is not essential. Follow vendor communications closely for updates on patches or official mitigations.