J2Store CVE-2026-67358

Exploitation requires an authenticated Joomla user account on the target site and at least one completed purchase through J2Store to obtain a valid order token - the attacker cannot exploit this from an anonymous session. The vulnerable endpoint is the download limit counter increment function within J2Store's digital product delivery subsystem; the site must be selling digital downloadable products with quota enforcement for the vulnerability to be exercisable. The attacker must additionally be able to enumerate or guess the order record identifiers belonging to other users; if order IDs are sequential integers, enumeration is trivial with minimal requests. A secondary CSRF attack path exists but requires a victim user (holding an active authenticated session) to visit an attacker-controlled page, adding a social engineering dependency. What limits exploitation: requires attacker registration and purchase on the target platform; impacts download counter integrity only, with no confidentiality exposure or system availability impact; J2Store must be configured with digital download products and quota enforcement enabled.

The CVSS 4.0 base score of 5.3 (Medium) is proportionate: exploitation requires an authenticated session with a valid order token (PR:L), and the worst-case outcome is manipulation of download counters rather than data exfiltration or service disruption, reflected in the limited VI:L impact with no confidentiality or availability consequence. The vulnerability is absent from the CISA KEV catalog and no proof-of-concept code has been identified, consistent with a low-to-moderate exploitation probability. EPSS data was not provided in the available intelligence, so comparative probability ranking against similar IDOR flaws cannot be performed. Despite the moderate CVSS score, the business impact on digital goods merchants can exceed what base metrics suggest: merchants whose revenue model depends on enforcing per-order download limits - even a mid-sized e-commerce platform processing hundreds of digital orders weekly - face tangible financial risk from quota exhaustion attacks. The dual weakness pattern (IDOR plus missing CSRF on the same endpoint) suggests insufficient authorization controls across the download management subsystem, warranting a broader code audit beyond the single reported endpoint. No conflicting signals exist between the CVSS vector and the description.

An authenticated J2Store customer logs in, completes a legitimate purchase to obtain a valid order token, then crafts HTTP requests to the download counter endpoint by substituting their token alongside a different (enumerated or guessed) order record identifier. By replaying this request repeatedly against targeted victim orders, the attacker inflates those counters and exhausts the permitted download limit for customers who purchased digital products, effectively denying them access to their purchases without triggering any payment fraud. No public exploit code exists at time of analysis.