J2Store EUVD-2026-64064

No authentication, CSRF token, or special session state is required - exploitation targets the unauthenticated file upload endpoint directly over HTTP with a standard multipart POST. The directory-exposure component is most reliably present on fresh installs of affected versions, since the installer manifest omits creation of protective .htaccess or web.config files in the upload and invoices directories; sites where those files were manually added or inherited from a parent-level configuration may partially limit direct file access but remain fully vulnerable to the CSRF bypass. PHP code execution from the uploaded file additionally requires that the web server not independently deny PHP execution in the upload directory, which is a common but not guaranteed control on shared and managed hosting. Exploitation is not limited by client OS, browser, or geographic network position - any HTTP client with access to the Joomla install suffices. The limiting factors are: (1) the target must be running an affected J2Store version, and (2) full RCE requires the upload directory to permit PHP execution, which depends on server configuration rather than application logic.

The CVSS 4.0 score of 6.9 with base metrics AV:N/AC:L/AT:N/PR:N/UI:N reflects zero-friction, fully unauthenticated remote exploitation requiring no attack complexity or preconditions - an HTTP client is sufficient. The supplemental metric E:A (Exploit Maturity: Attacked) embedded in the provided vector is a strong signal of active in-the-wild exploitation, though this conflicts with the absence of a CISA KEV entry in the source data; defenders should verify current KEV status independently. The impact metrics VC:N/VI:L/VA:N/SC:N/SI:L/SA:N suggest the scoring assessor rated impact conservatively as limited file-write integrity, likely because confirmed PHP execution in the upload directory was not independently demonstrated - however, on Apache environments without independent PHP blocking in upload directories, actual impact could escalate to full remote code execution. The vulnerability spans three major release branches of J2Store, maximizing the exposed installation base. The supplemental Recovery metric R:A (Recovery: Automatic) reflects that the system state can be restored by removing uploaded files, but this does not mitigate the underlying CSRF bypass.

An unauthenticated attacker sends a crafted HTTP POST request to the J2Store file upload endpoint on a freshly installed, network-reachable Joomla site, submitting a PHP webshell without providing any session cookie or CSRF token - the request is accepted and the file is written to the upload or invoices directory. Because those directories lack .htaccess protection, the attacker retrieves the shell via a direct URL and, if the server does not independently block PHP execution in the upload path, achieves remote code execution under the web server process account. No public POC was identified in the provided source data, but the CVSS 4.0 E:A metric indicates active exploitation has been observed.