J2Store CVE-2026-67360

Exploitation requires the attacker to hold a valid authenticated account on the J2Store-powered Joomla site - unauthenticated exploitation is ruled out by the description and is inconsistent with the application flow. The attacker must also know or successfully enumerate a victim's order_id; if order IDs are sequential integers, this is straightforward; if they are UUIDs or opaque tokens, enumeration is significantly harder. The vulnerable cart-copy feature must be accessible in the deployed J2Store version and not disabled by site configuration. What limits exploitation: authentication is required (preventing anonymous abuse), order_id must be discoverable (non-trivial on stores using opaque identifiers), and impact is bounded to cart contents and address data - no payment card data or account credentials are directly exposed through this vector.

Real-world risk is moderate and bounded. The CVSS 4.0 vector supplied (AV:N/AC:L/AT:P/PR:N/UI:N) carries a notable internal contradiction with the vulnerability description: the description explicitly requires an authenticated user, yet the vector specifies PR:N (no privileges). This discrepancy should be verified with the vendor. The AT:P metric (attack requirements present) is appropriate, as an attacker must know or enumerate a victim's order_id, which is a non-trivial but achievable barrier on high-traffic stores. The VC:N metric in the provided vector also understates the actual impact, since copying a victim's shipping address constitutes a confidentiality exposure - this appears to be an error in the supplied scoring. EPSS data is not available in the provided intelligence, and there is no KEV listing, meaning no confirmed active exploitation. Overall, this is a real confidentiality and integrity issue for multi-tenant Joomla storefronts - customer address data and purchase history can leak to other authenticated users - but it requires an account and successful order_id enumeration, limiting mass exploitation. High-volume public stores accepting guest checkout who convert to accounts carry greater risk than closed B2B deployments.

An attacker with a valid J2Store account on the target Joomla site logs in and submits a POST request to the order-copy endpoint, substituting a guessed or enumerated victim order_id in place of their own. Because no ownership check is performed, the server populates the attacker's session with the victim's cart items and shipping address. The attacker can then proceed to checkout or extract the prefilled address data, achieving horizontal privilege escalation without any additional permissions.