EUVD-2026-70444
GHSA-vwvh-r394-jv9x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable IDOR requiring any valid account (PR:L); confidentiality impact high (full PII); no integrity or availability impact.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
Lifecycle Timeline
3DescriptionCVE.org
Joomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user (IDOR) in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - editAddress() redirected non-owners away only when the loaded address row had a non-empty user_id belonging to someone else. Guest-checkout address rows have an empty user_id, so that check never triggered for them - any logged-in account guessing a small, sequential address_id got a guest customer's full name, street address, and phone number rendered prefilled into the edit form.
AnalysisAI
Guest checkout address IDOR in J2Store Joomla extension exposes personally identifiable information of guest purchasers to any authenticated site user. The editAddress() function's ownership guard only fires when the address row carries a non-empty user_id; guest-checkout rows have a null user_id, silently bypassing the check. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Joomla user account on the target site (any role - subscriber-level is sufficient) and the site must have accepted at least one guest checkout, meaning J2Store's guest checkout feature must be enabled (a common default for e-commerce). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) yields a score of 7.1, accurately reflecting that exploitation requires a valid site account (PR:L) but no special privileges, no user interaction, and no complex configuration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No exact patched version is identified in the provided data; the reference points only to the vendor homepage at https://www.j2commerce.com/ with no specific advisory or changelog. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify which J2Store version(s) are deployed and audit the count of guest checkout orders in affected systems; document which user roles have administrative access to the plugin. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in J2Store Extension For Joomla
View allMissing authorization in J2Store, the J2Commerce e-commerce extension for Joomla, lets remote attackers reach the `J2Sto
Cart-record tampering in J2Store (Joomla e-commerce extension by j2commerce.com) affects all versions across the 1.0.0-3
Order content disclosure in J2Store (Joomla e-commerce extension by j2commerce.com) versions 1.0.0-3.3.20, 4.0.0-4.0.20,
Unauthenticated PayPal IPN callback forgery in J2Store (Joomla e-commerce extension) versions 1.0.0-3.3.21, 4.0.0-4.0.21
Stored Cross-Site Scripting in J2Store and J2Commerce allows unauthenticated attackers to inject persistent malicious sc
Unauthenticated file upload in J2Store (Joomla e-commerce extension) versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.
Cross-customer order replication in J2Store (Joomla extension by j2commerce.com, versions 1.0.0-3.3.20, 4.0.0-4.0.20, an
Download quota manipulation in J2Store versions 1.0.0 through 4.1.5 for Joomla allows authenticated users to increment d
Reflected XSS and open-redirect flaws in J2Store, a Joomla e-commerce extension by j2commerce.com, allow unauthenticated
Open redirect in the J2Store Joomla e-commerce extension (versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5) enables
Share
External POC / Exploit Code
Leaving vuln.today