J2Store CVE-2026-74252

The attacker must submit a guest checkout without authentication - PR:N is confirmed by the CVSS 4.0 vector. The guest checkout feature must be enabled on the target Joomla site; disabling it removes the unauthenticated injection path. The PHP runtime must use the default variables_order=EGPCS configuration; a non-default ordering that deprioritizes Cookie over POST would close the bypass vector. Affected versions span 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5 of J2Store and J2Commerce 4.1.5 - sites running versions outside these ranges are not confirmed affected. Payload execution further requires that a privileged backend user (administrator or order manager) actively views the malicious order record (UI:A per CVSS 4.0); the payload does not execute at submission time. No special network position or local access is required - the attack is fully remote over standard HTTP or HTTPS.

The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L) reflects a high-severity attack that is network-accessible, requires no authentication, and imposes no special attack requirements, but depends on a privileged backend user actively viewing the malicious order record before the payload fires. Attack complexity is low - the Cookie override technique is a documented PHP/Joomla input-handling quirk, making automated mass submission of poisoned checkout orders straightforward. No EPSS score was supplied in the provided data, so probabilistic exploitation likelihood cannot be quantified; the absence of a CISA KEV entry indicates no confirmed widespread in-the-wild exploitation at time of analysis. The high VC and VI impact metrics are consistent with the realistic worst case of admin session hijacking, which would grant an attacker full control over the Joomla store backend including customer PII and payment configuration. Organizations running Joomla-based storefronts should treat this as a priority given the zero-authentication submission path, even though payload execution is contingent on admin activity rather than firing on submission alone.

An unauthenticated attacker visits the J2Store guest checkout page and submits a purchase order with a crafted Cookie header containing a JavaScript payload (for example, a session cookie exfiltration script) as the value for billing_first_name. PHP's EGPCS variable merge order causes this Cookie value to override the legitimate POST value in $_REQUEST, so Joomla's Input::getArray() sanitizes the benign POST value while the malicious Cookie value is stored verbatim in the database. When a store administrator later opens the order record in the backend, the stored script executes in the admin's browser and can exfiltrate the session cookie to an attacker-controlled server, granting full administrative access to the store.