EUVD-2026-70414
GHSA-jjf7-8pp5-x8vw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network endpoint with no complexity barriers; integrity high for arbitrary cart writes; confidentiality low for row-ID inference; no availability impact; scope unchanged within Joomla.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF save task in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - fof.xml grants the carts view's tasks a wildcard true ACL, and FOF only enforces CSRF tokens on back-end HTML requests, not on front-end format=raw requests. J2StoreControllerCarts already scoped remove() to the caller's own session, but never overrode the generic FOF save task, so it remained reachable to insert new cart rows with an attacker-chosen user_id/session_id, or overwrite an existing row by id.
AnalysisAI
Cart-record tampering in J2Store (Joomla e-commerce extension by j2commerce.com) affects all versions across the 1.0.0-3.3.21, 4.0.0-4.0.21, and 4.1.0-4.1.6 release lines via an unoverridden inherited FOF framework save task reachable by unauthenticated front-end requests. The controller correctly restricted remove() to the caller's own session but never overrode the generic FOF save task, leaving it exposed to unauthenticated format=raw POST requests that can insert new cart rows with attacker-chosen user_id/session_id values or overwrite existing rows by numeric ID. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The targeted Joomla installation must have J2Store installed and active in a version within the ranges 1.0.0-3.3.21, 4.0.0-4.0.21, or 4.1.0-4.1.6, and the storefront must be publicly reachable (the default for any live shop). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, score 8.8) accurately captures a low-complexity, unauthenticated, network-reachable attack with no additional timing or environment dependencies. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No confirmed patched release version is identified in the available data; operators should monitor https://www.j2commerce.com/ for a security advisory and upgrade to the first published fixed release as soon as it is available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Joomla installations to identify J2Store instances and document their versions (found in /administrator/components/com_j2store/j2store.xml); create a spreadsheet of affected sites and their network exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in J2Store Extension For Joomla
View allMissing authorization in J2Store, the J2Commerce e-commerce extension for Joomla, lets remote attackers reach the `J2Sto
Order content disclosure in J2Store (Joomla e-commerce extension by j2commerce.com) versions 1.0.0-3.3.20, 4.0.0-4.0.20,
Unauthenticated PayPal IPN callback forgery in J2Store (Joomla e-commerce extension) versions 1.0.0-3.3.21, 4.0.0-4.0.21
Stored Cross-Site Scripting in J2Store and J2Commerce allows unauthenticated attackers to inject persistent malicious sc
Guest checkout address IDOR in J2Store Joomla extension exposes personally identifiable information of guest purchasers
Unauthenticated file upload in J2Store (Joomla e-commerce extension) versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.
Cross-customer order replication in J2Store (Joomla extension by j2commerce.com, versions 1.0.0-3.3.20, 4.0.0-4.0.20, an
Download quota manipulation in J2Store versions 1.0.0 through 4.1.5 for Joomla allows authenticated users to increment d
Reflected XSS and open-redirect flaws in J2Store, a Joomla e-commerce extension by j2commerce.com, allow unauthenticated
Open redirect in the J2Store Joomla e-commerce extension (versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5) enables
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today