J2Store EUVD-2026-70415

The PayPal IPN listener endpoint must be enabled - this is required for any PayPal-integrated J2Store installation using IPN, which is the default PayPal integration mode. The attacker requires two values: the merchant's PayPal receiver_email address (publicly visible on most merchant sites in PayPal button markup or discoverable from prior transaction metadata) and a valid pending order ID, which the advisory explicitly describes as sequential and enumerable. No authentication is required. The attack is limited to orders in pending status; already-confirmed or completed orders are not susceptible to the confirmation bypass. The paypalv2.php code path bypasses the amount check unconditionally and is not subject to the mc_gross omission technique - it requires no preconditions at all beyond a reachable endpoint. The attack works regardless of whether SSL is enforced on the IPN endpoint itself, because the vulnerability is in server-side logic, not transport.

Real-world risk is high for any merchant running a vulnerable J2Store version with PayPal IPN enabled. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N) scoring 8.7 accurately reflects the attack surface: network-reachable, no privileges, no user interaction, and high integrity impact. The attack requires only two pieces of information - the merchant's PayPal receiver_email (typically visible on the merchant's site or in previous PayPal transactions) and a valid pending order ID (explicitly described as sequential and enumerable). No special conditions, authentication, or timing requirements exist. The secondary impact - forcing another customer's order to FAILED - is an underappreciated denial-of-service against order integrity. No KEV listing or public exploit code has been identified, but the vulnerability is self-documenting from the advisory description and requires no binary analysis or fuzzing; any developer familiar with PHP and PayPal IPN can construct a working exploit in minutes. EPSS data is absent from the provided input.

An attacker browsing a J2Store-powered Joomla shop places a legitimate order to learn its sequential order ID and observes the merchant's PayPal receiver_email (typically embedded in PayPal buttons on the checkout page). The attacker then sends a forged HTTP POST to the store's IPN endpoint, omitting mc_gross to bypass the amount check and supplying the target order's ID in the custom field, causing the store to mark the order CONFIRMED and fulfill it without any payment having been processed. The same technique applied to another customer's pending order ID sets that order to FAILED, disrupting a legitimate transaction.