J2Store EUVD-2026-64060

No special conditions are required beyond network access to a Joomla site running an affected version of J2Store. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms unauthenticated remote exploitation against default configurations of J2Store - the attacker only needs to supply an arbitrary order_id as a query parameter to the publicly accessible checkout confirmation page. The primary limiting factor on impact (not exploitation) is knowledge of valid order IDs; however, if IDs are sequential integers - as is standard in most e-commerce platforms - enumeration is trivial and requires no prior reconnaissance. Guest checkout orders (where no registered account is associated) are equally exposed. There is no requirement for the attacker to be a registered user, to hold any session cookie, or to have any prior interaction with the target store.

The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N accurately reflects the real-world risk profile: network-reachable, zero prerequisites, no user interaction, and high confidentiality impact against the vulnerable system. The impact is strictly read-only - integrity and availability are unaffected - but the confidentiality exposure is significant: full order details may include customer names, shipping addresses, purchased items, quantities, and payment totals, constituting sensitive PII and potentially regulated data under GDPR, PCI-DSS, or CCPA frameworks. EPSS data is absent from the available input, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV and no public POC has been identified, meaning active exploitation is not confirmed. However, the absence of exploitation evidence should not be conflated with low risk: the attack requires nothing more than an HTTP GET request, making it accessible to unskilled actors. The sequential nature of typical e-commerce order IDs dramatically amplifies the realistic blast radius from a single order disclosure to a full store data dump. This is a real, high-priority remediation target - not a theoretical high-CVSS-but-low-real-risk issue.

An unauthenticated attacker sends HTTP GET requests to the J2Store checkout confirmation endpoint with incrementing order_id values, receiving the full rendered order page for each valid ID. Because no authentication or session binding is enforced, the attacker can automate enumeration across the entire order history of the store with a simple script. No public POC has been identified at time of analysis, but the attack requires no specialized tooling.