The Easy Store extension for Joomla (versions 1.0.0 to 3.0.0) had a missing CSRF token verification on multiple administrator AJAX API endpoints except for the products() action. This allowed state-changing requests (POST, PUT, PATCH, DELETE) on endpoints such as orders, coupons, media, customers, settings, tags, categories, reviews, and collections to be processed without anti-CSRF token checks. The vulnerability could be exploited by tricking an authenticated administrator into executing unauthorized actions. The fix involved adding global CSRF token verification in the ApiController::execute() method using Session::checkToken() for all state-changing HTTP methods.

An attacker could exploit this vulnerability to perform unauthorized state modifications on the store backend by leveraging a logged-in administrator's session. This could lead to manipulation of orders, coupons, media, customers, settings, tags, categories, reviews, and collections within the Easy Store extension. The CVSS 4.0 score of 7.2 (high severity) reflects the network attack vector, low attack complexity, no privileges required, but user interaction needed, with high impact on integrity and availability.

A fix is available that implements global CSRF token verification for all state-changing HTTP methods in the ApiController. Users should upgrade to a patched version of the Easy Store extension where this fix is applied. Since no specific patch links are provided, users should consult the vendor joomshaper.com for the official update or advisory. Until patched, administrators should be cautious of unsolicited requests and avoid interacting with untrusted content while logged into the Joomla backend.