J2Store CVE-2026-78065

Exploitation requires a valid Joomla user account on the target site (any role - subscriber-level is sufficient) and the site must have accepted at least one guest checkout, meaning J2Store's guest checkout feature must be enabled (a common default for e-commerce). Address IDs must be guessable, which is trivially satisfied by the sequential integer scheme. Exploitation is limited to confidentiality impact (read-only form prefill); address modification is not possible through this vector. Sites that disable guest checkout entirely and require account creation for all purchases are not affected, as all address rows will carry non-empty user_id values.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) yields a score of 7.1, accurately reflecting that exploitation requires a valid site account (PR:L) but no special privileges, no user interaction, and no complex configuration. The confidentiality impact is high because full PII (name, address, phone) is exposed for every guest order. Integrity and availability are unaffected - the IDOR surfaces data through a read-only form prefill; the data cannot be modified via this vector. Real-world risk is meaningful for any J2Store deployment that accepts guest checkouts, which is a common e-commerce configuration. The sequential nature of address_id makes bulk harvesting of guest PII feasible with minimal effort. No EPSS score or KEV listing is available in the provided data, and no public exploit has been identified; however, the attack is so low-complexity that absence of a published POC does not significantly reduce risk once the vulnerability is disclosed.

An attacker registers a free account on a J2Store-powered Joomla e-commerce site (or uses any existing account). They then send authenticated GET requests to the editAddress controller endpoint, incrementing the address_id parameter from 1 upward. For each guest order in the database, the server renders a prefilled form containing the guest's full name, street address, and phone number, allowing bulk PII harvesting of all guest purchasers with no further privileges required.