The Easy Store extension for Joomla versions 1.0.0 to 3.0.0 contained an unauthenticated server-side endpoint (checkout.searchGuestUser) that allowed attackers to retrieve guest checkout records solely by supplying an email address. The server returned complete shipping details from the #__easystore_guests database table without any authentication, session validation, or ownership verification. This allowed attackers to enumerate guest customers and harvest sensitive PII. The vulnerability is categorized as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, 'Injection'). The vendor remediated the issue by removing the unauthenticated endpoint and migrating autofill functionality to client-side localStorage protected by explicit user consent.

An unauthenticated attacker could exploit this vulnerability to enumerate guest checkout users by iterating through email addresses and retrieve sensitive personal information including full names, phone numbers, street addresses, cities, postal codes, and countries. This leads to a significant privacy breach and potential misuse of PII. The vulnerability does not require user interaction and has a network attack vector with low complexity, making it a high-severity risk.

The vulnerability has been resolved by the vendor through removal of the unauthenticated server-side guest lookup endpoint and migration of autofill functionality to client-side localStorage with explicit user consent. Users of affected versions (1.0.0 through 3.0.0) should upgrade to a fixed version once available or apply vendor-provided patches if any. Since no patch links are provided, check the vendor advisory for the latest remediation guidance.