EUVD-2026-64060
GHSA-729h-pf7j-c7xw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-accessible IDOR with no complexity or interaction required; impact is confidentiality-only with no integrity or availability effect and no scope change.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any order_id as a query parameter to render the full checkout confirmation page for that order, including line items, prices, and totals.
AnalysisAI
Order content disclosure in J2Store (Joomla e-commerce extension by j2commerce.com) versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5 allows any unauthenticated visitor to read the full checkout confirmation of arbitrary orders - including line items, prices, and totals - by supplying a controlled order_id query parameter, with no authentication required. This is a textbook CWE-639 Insecure Direct Object Reference flaw: the application fails to verify that the requesting party owns or is authorized to view the referenced order record. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond network access to a Joomla site running an affected version of J2Store. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N accurately reflects the real-world risk profile: network-reachable, zero prerequisites, no user interaction, and high confidentiality impact against the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to upgrade J2Store to a version beyond the affected ranges - above 3.3.20 for the 3.x branch, above 4.0.20 for the 4.0.x branch, and above 4.1.5 for the 4.1.x branch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Joomla instances running J2Store versions 1.0.0-3.3.20, 4.0.0-4.0.20, or 4.1.0-4.1.5; assess which handle customer order data and review access logs for suspicious order_id parameter queries. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in J2Store Extension For Joomla
View allStored Cross-Site Scripting in J2Store and J2Commerce allows unauthenticated attackers to inject persistent malicious sc
Unauthenticated file upload in J2Store (Joomla e-commerce extension) versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.
Cross-customer order replication in J2Store (Joomla extension by j2commerce.com, versions 1.0.0-3.3.20, 4.0.0-4.0.20, an
Download quota manipulation in J2Store versions 1.0.0 through 4.1.5 for Joomla allows authenticated users to increment d
Open redirect in the J2Store Joomla e-commerce extension (versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5) enables
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today