EUVD-2026-79286Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (Joomla) · only source for this CVE.
CVSS VectorVendor: Joomla
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated denial-of-service against the order pipeline: mass-failing pending orders to disrupt revenue and force manual reprocessing, or flipping already-fulfilled orders back to FAILED to cause operational confusion (unwarranted refunds/cancellations, customer-support load). Unlike the earlier confirmation-fraud issue, this required no correct payment amount or transaction data at all.
AnalysisAI
Unauthenticated order-state tampering in the J2Store e-commerce extension for Joomla (versions 1.0.0–3.3.2, 4.0.0–4.0.22, and 4.1.0–4.1.7) lets anyone mark any order as FAILED without supplying a payment amount, transaction ID, or any other verification data. An attacker can mass-fail pending orders to disrupt revenue, or flip already-fulfilled orders back to FAILED, triggering unwarranted refunds, cancellations, and customer-support load. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
More in J2Store Extension For Joomla
View allMissing authorization in J2Store, the J2Commerce e-commerce extension for Joomla, lets remote attackers reach the `J2Sto
Cart-record tampering in J2Store (Joomla e-commerce extension by j2commerce.com) affects all versions across the 1.0.0-3
Order content disclosure in J2Store (Joomla e-commerce extension by j2commerce.com) versions 1.0.0-3.3.20, 4.0.0-4.0.20,
An arbitrary file read flaw in the J2Store e-commerce extension for Joomla (versions 1.0.0–3.3.2, 4.0.0–4.0.22 and 4.1.0
Unauthenticated blind SQL injection in the J2Store e-commerce extension for Joomla allows remote attackers to extract ar
Unauthenticated PayPal IPN callback forgery in J2Store (Joomla e-commerce extension) versions 1.0.0-3.3.21, 4.0.0-4.0.21
Stored Cross-Site Scripting in J2Store and J2Commerce allows unauthenticated attackers to inject persistent malicious sc
Cross-site request forgery in the J2Store e-commerce extension for Joomla (versions 1.0.0–3.3.2, 4.0.0–4.0.22 and 4.1.0–
Guest checkout address IDOR in J2Store Joomla extension exposes personally identifiable information of guest purchasers
Unauthenticated file upload in J2Store (Joomla e-commerce extension) versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.
Cross-customer order replication in J2Store (Joomla extension by j2commerce.com, versions 1.0.0-3.3.20, 4.0.0-4.0.20, an
Download quota manipulation in J2Store versions 1.0.0 through 4.1.5 for Joomla allows authenticated users to increment d
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today