J2Store EUVD-2026-64061

No authentication is required - any unauthenticated remote user who can send HTTP requests to the publicly accessible J2Store cart controller can initiate the redirect. The victim end-user must follow a crafted link (UI:A), making this a social-engineering-dependent attack rather than a fully automated one. The targeted Joomla site must be running an unpatched J2Store version within the affected ranges (1.0.0-3.3.20, 4.0.0-4.0.20, or 4.1.0-4.1.5) with the cart controller publicly reachable - no non-default configuration is required beyond a standard J2Store installation. Exploitation is bounded to redirect-abuse for phishing purposes and does not yield server-side code execution, direct data exfiltration from the server, or availability impact.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) places this at 5.1, reflecting low-complexity unauthenticated network reachability constrained by required victim interaction, with no direct vulnerable-system impact (VC:N/VI:N/VA:N) and only low subsequent-system confidentiality and integrity effects (SC:L/SI:L/SA:N). No EPSS data was provided, KEV status is absent, and no POC has been identified in the available intelligence, so exploitation probability cannot be precisely quantified beyond what the CVSS vector implies. The real-world risk is primarily reputational and social-engineering-driven: attackers craft redirect URLs hosted on the legitimate shop domain to phish customers for credentials or payment data. The UI:A constraint - victim must follow a crafted link - is the principal limiting factor, but in e-commerce contexts this is easily satisfied via promotional email campaigns, order confirmation messages, or chat-based lures. The broad affected version range (all 3.x through 3.3.20, all 4.0.x through 4.0.20, all 4.1.x through 4.1.5) and the absence of any authentication prerequisite widen the potential target pool considerably. The CVSS score reasonably reflects the bounded impact scope; the primary gap in this assessment is the absence of EPSS telemetry and any exploitation confirmation.

An attacker identifies a J2Store-powered online shop running an affected version and constructs a cart controller URL embedding a base64-encoded pointer to an attacker-controlled phishing page. The attacker distributes this URL via email or social media, making it appear to originate from the legitimate merchant domain. When a victim clicks the link, their browser briefly contacts the real shop domain before being silently redirected to the fake site, where the attacker harvests credentials or payment details under the guise of a trusted storefront.