EUVD-2026-70445
GHSA-7345-4p68-cx7g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable unauthenticated path (AV:N/PR:N/UI:N) but only exploitable if the incidental fof.xml 403 deny does not hold (AC:H); file-read plus SQL execute and table truncation give C/I/A:H, contained in-app so S:U.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - J2StoreControllerApps's appTask delegation path instantiates app-plugin controllers with no ACL check anywhere in the code. It currently returns 403 only as a side effect of fof.xml's wildcard-deny resolving under the singularised ACL key app, which has no explicit allow rule - not because of any deliberate check. Behind that path, applocalizationdata::getInstallerTool() used a caller-influenced table name with no allow-list, both to select a #__j2store_* table for truncation and to build a path to SQL files it then executes - a path-traversal-capable file read/execute.
AnalysisAI
Missing authorization in J2Store, the J2Commerce e-commerce extension for Joomla, lets remote attackers reach the J2StoreControllerApps appTask delegation path - which instantiates app-plugin controllers with no ACL check - and drive applocalizationdata::getInstallerTool() with a caller-influenced, non-allow-listed table name to truncate #__j2store_* tables and construct a path-traversal-capable path to SQL files it then executes. This yields a file-read/execute primitive affecting J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, and 4.1.0-4.1.6. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation targets the `J2StoreControllerApps` `appTask` delegation path in J2Store (1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6) and requires the attacker to (a) reach that Apps-controller delegation endpoint over HTTP and (b) supply a caller-influenced table name consumed by `applocalizationdata::getInstallerTool()`. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector (9.5, AV:N/AC:L/AT:P/PR:N/UI:N with all base and subsequent impacts High) reflects an unauthenticated network-reachable path to a file-read/SQL-execute primitive, which is genuinely severe if reachable. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available data - the only reference is the J2Commerce homepage (https://www.j2commerce.com/), so administrators should monitor J2Commerce/J2Store release notes for a build newer than 4.1.6 (and the 3.3.x/4.0.x branches) that adds an explicit ACL check on the Apps controller delegation chain, then upgrade to it. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Joomla instances running J2Store by version; immediately block access to the J2Store component via firewall rules, WAF policies, or webserver configuration to prevent exploitation of the vulnerable appTask parameter. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in J2Store Extension For Joomla
View allCart-record tampering in J2Store (Joomla e-commerce extension by j2commerce.com) affects all versions across the 1.0.0-3
Order content disclosure in J2Store (Joomla e-commerce extension by j2commerce.com) versions 1.0.0-3.3.20, 4.0.0-4.0.20,
An arbitrary file read flaw in the J2Store e-commerce extension for Joomla (versions 1.0.0–3.3.2, 4.0.0–4.0.22 and 4.1.0
Unauthenticated blind SQL injection in the J2Store e-commerce extension for Joomla allows remote attackers to extract ar
Unauthenticated order-state tampering in the J2Store e-commerce extension for Joomla (versions 1.0.0–3.3.2, 4.0.0–4.0.22
Unauthenticated PayPal IPN callback forgery in J2Store (Joomla e-commerce extension) versions 1.0.0-3.3.21, 4.0.0-4.0.21
Stored Cross-Site Scripting in J2Store and J2Commerce allows unauthenticated attackers to inject persistent malicious sc
Cross-site request forgery in the J2Store e-commerce extension for Joomla (versions 1.0.0–3.3.2, 4.0.0–4.0.22 and 4.1.0–
Guest checkout address IDOR in J2Store Joomla extension exposes personally identifiable information of guest purchasers
Unauthenticated file upload in J2Store (Joomla e-commerce extension) versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.
Cross-customer order replication in J2Store (Joomla extension by j2commerce.com, versions 1.0.0-3.3.20, 4.0.0-4.0.20, an
Download quota manipulation in J2Store versions 1.0.0 through 4.1.5 for Joomla allows authenticated users to increment d
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today