J2Commerce Com

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-78069	Missing authorization in J2Store, the J2Commerce e-commerce extension for Joomla, lets remote attackers reach the `J2StoreControllerApps` `appTask` delegation path - which instantiates app-plugin controllers with no ACL check - and drive `applocalizationdata::getInstallerTool()` with a caller-influenced, non-allow-listed table name to truncate `#__j2store_*` tables and construct a path-traversal-capable path to SQL files it then executes. This yields a file-read/execute primitive affecting J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, and 4.1.0-4.1.6. There is no public exploit identified at time of analysis, and access is currently blocked only as an accidental side effect of an `fof.xml` wildcard-deny rather than a deliberate control.	CRITICAL	9.5	0.2%	48	No patch
CVE-2026-78064	Cart-record tampering in J2Store (Joomla e-commerce extension by j2commerce.com) affects all versions across the 1.0.0-3.3.21, 4.0.0-4.0.21, and 4.1.0-4.1.6 release lines via an unoverridden inherited FOF framework `save` task reachable by unauthenticated front-end requests. The controller correctly restricted `remove()` to the caller's own session but never overrode the generic FOF `save` task, leaving it exposed to unauthenticated `format=raw` POST requests that can insert new cart rows with attacker-chosen `user_id`/`session_id` values or overwrite existing rows by numeric ID. No public exploit has been identified at time of analysis, but the zero-authentication, low-complexity network vector makes this trivially exploitable against any publicly reachable J2Store storefront.	HIGH	8.8	0.2%	44	No patch
CVE-2026-67359	Order content disclosure in J2Store (Joomla e-commerce extension by j2commerce.com) versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5 allows any unauthenticated visitor to read the full checkout confirmation of arbitrary orders - including line items, prices, and totals - by supplying a controlled order_id query parameter, with no authentication required. This is a textbook CWE-639 Insecure Direct Object Reference flaw: the application fails to verify that the requesting party owns or is authorized to view the referenced order record. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivially low exploitation barrier (unauthenticated, network-accessible, likely sequential order IDs) makes this a high-priority remediation target for any J2Store deployment handling customer order data.	HIGH	8.7	0.3%	44	No patch
CVE-2026-77999	Unauthenticated PayPal IPN callback forgery in J2Store (Joomla e-commerce extension) versions 1.0.0-3.3.21, 4.0.0-4.0.21, and 4.1.0-4.1.6 allows any anonymous attacker to confirm orders without payment or force other customers' orders to FAILED status. The vulnerability stems from three compounding flaws: a signature verification function that treated UNVERIFIED as acceptable, disabled TLS peer verification on the outbound PayPal check, and amount validation that could be entirely bypassed by omitting the mc_gross field - making the IPN endpoint trivially forgeable with a plain unauthenticated HTTP POST. No public exploit has been identified at time of analysis, but the attack is trivially constructable from the description alone given enumerable order IDs and a merchant receiver_email that is typically public.	HIGH	8.7	0.3%	44	No patch
CVE-2026-81567	Unauthenticated blind SQL injection in the J2Store e-commerce extension for Joomla allows remote attackers to extract arbitrary database contents — including customer records, order data, and stored credentials or tokens — from any publicly reachable storefront that exposes the standard product listing or product-tags filter. Affected builds span the 1.x, 3.x, 4.0.x and 4.1.x lines (1.0.0–3.3.2, 4.0.0–4.0.22, 4.1.0–4.1.7), and the CVSS 4.0 vector indicates network-reachable exploitation with no authentication and no user interaction (PR:N/UI:N) for a high confidentiality impact. No public exploit code, EPSS score, or CISA KEV entry was supplied in the intelligence feed, so active exploitation is currently unconfirmed.	HIGH	8.7	–	44	No patch
CVE-2026-81568	An arbitrary file read flaw in the J2Store e-commerce extension for Joomla (versions 1.0.0–3.3.2, 4.0.0–4.0.22 and 4.1.0–4.1.7) lets anyone holding a valid download token/pid pair for a product download retrieve files outside the configured attachment folder. The J2StoreModelOrderdownloads::getFilePath() routine builds the on-disk path by concatenating the attachments directory with the stored product_file_save_name and only runs JPath::clean() plus JFile::exists(), so a ../ segment in that stored value resolves outside the folder and exposes files such as configuration.php to the web server's read permissions. No public exploit code and no CISA KEV listing were identified at time of analysis, but a CVSS 4.0 base score of 8.7 (VC:H, AV:N, PR:N) makes this a serious confidentiality risk for exposed J2Store storefronts.	HIGH	8.7	–	44	No patch
CVE-2026-82189	Unauthenticated order-state tampering in the J2Store e-commerce extension for Joomla (versions 1.0.0–3.3.2, 4.0.0–4.0.22, and 4.1.0–4.1.7) lets anyone mark any order as FAILED without supplying a payment amount, transaction ID, or any other verification data. An attacker can mass-fail pending orders to disrupt revenue, or flip already-fulfilled orders back to FAILED, triggering unwarranted refunds, cancellations, and customer-support load. The CVE carries a CVSS 4.0 score of 8.7 driven entirely by high integrity impact; no public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis.	HIGH	8.7	–	44	No patch
CVE-2026-74252	Stored Cross-Site Scripting in J2Store and J2Commerce allows unauthenticated attackers to inject persistent malicious scripts via guest checkout billing address fields, affecting all versions from 1.0.0 through 4.1.5. The exploit abuses an interaction between Joomla's Input::getArray() sanitization and PHP's default variables_order=EGPCS setting, where Cookie values silently override POST parameters in $_REQUEST, allowing unsanitized HTML to persist in fields such as billing_first_name. When a privileged user such as a store administrator subsequently views the affected order record, the stored payload executes in their browser session. No public exploit code or CISA KEV listing has been identified at time of analysis.	HIGH	8.6	0.3%	43	No patch
CVE-2026-78065	Guest checkout address IDOR in J2Store Joomla extension exposes personally identifiable information of guest purchasers to any authenticated site user. The `editAddress()` function's ownership guard only fires when the address row carries a non-empty `user_id`; guest-checkout rows have a null `user_id`, silently bypassing the check. Any registered Joomla account can iterate sequential `address_id` integers to retrieve full name, street address, and phone number for all guest orders across J2Store versions 1.0.0 through 3.3.21, 4.0.0 through 4.0.21, and 4.1.0 through 4.1.6. No public exploit has been identified at time of analysis, but the attack is trivially simple for any authenticated user.	HIGH	7.1	0.2%	36	No patch
CVE-2026-78081	Cross-site request forgery in the J2Store e-commerce extension for Joomla (versions 1.0.0–3.3.2, 4.0.0–4.0.22 and 4.1.0–4.1.7) allows an attacker to silently overwrite a shopper's billing or shipping address while their checkout session is active, potentially redirecting a paid order to an attacker-controlled address. The cart, checkout and myprofile controllers omit CSRF token validation, so each forged request executes only with the victim's own session privileges — there is no cross-account data access. No public exploit code or active exploitation has been identified at time of analysis.	HIGH	7.1	–	36	No patch
CVE-2026-67361	Unauthenticated file upload in J2Store (Joomla e-commerce extension) versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5 permits any remote visitor to POST arbitrary files to the upload endpoint without authentication or CSRF validation. A compounding installer manifest defect omits .htaccess and web.config protection for the upload and invoices directories on fresh installs, making uploaded files directly web-accessible over HTTP. The provided CVSS 4.0 vector includes E:A (Exploit Maturity: Attacked), indicating active exploitation is confirmed at the scoring level, though no corresponding CISA KEV entry was present in the supplied intelligence data.	MEDIUM	6.9	0.2%	35	No patch
CVE-2026-67360	Cross-customer order replication in J2Store (Joomla extension by j2commerce.com, versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5) allows an authenticated attacker to supply an arbitrary order_id and copy another customer's cart contents and shipping address data directly into the attacker's own session. The root cause is absent ownership validation on the order copy function - CSRF tokens are checked, preventing cross-site request forgery, but the back-end never verifies that the order_id belongs to the requesting user. No public exploit code and no CISA KEV listing have been identified at time of analysis.	MEDIUM	6.3	0.2%	32	No patch
CVE-2026-67358	Download quota manipulation in J2Store versions 1.0.0 through 4.1.5 for Joomla allows authenticated users to increment download limit counters on digital product orders they do not own, undermining purchased access controls for other customers. The flaw is an Insecure Direct Object Reference (IDOR) in the download counter endpoint, which accepts a user-supplied order record identifier without verifying ownership against the authenticated session's order token; the same endpoint also lacks CSRF token validation, widening the attack surface. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.	MEDIUM	5.3	0.1%	27	No patch
CVE-2026-78000	Reflected XSS and open-redirect flaws in J2Store, a Joomla e-commerce extension by j2commerce.com, allow unauthenticated network attackers to inject malicious scripts into victim browsers via the `filter_tag`, `pricefrom`, and `priceto` parameters across all 3.x releases through 3.3.21 and all 4.x releases through 4.1.6. Four task handlers additionally accept base64-encoded redirect URLs without destination-host validation, enabling phishing attacks that abuse the shop's trusted domain to mislead customers into visiting attacker-controlled sites. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.	MEDIUM	5.3	0.3%	26	No patch
CVE-2026-82191	Parameter smuggling into the PayPal notify redirect of the J2Store extension for Joomla (versions 1.0.0-3.3.2, 4.0.0-4.0.22, and 4.1.0-4.1.7) lets an attacker-chosen query string ride along with the redirect that the notify endpoint issues to com_j2store's checkout controller, instead of the intended fixed parameter set. A victim must load the crafted link (UI:P in the CVSS 4.0 vector), after which the follow-up request to the checkout controller is processed with the injected view/task/paction parameters, giving a limited integrity impact (VI:L) with no confidentiality or availability loss. The vendor's own description concedes this does not grant an unauthenticated attacker anything they could not obtain by calling the same com_j2store URL directly; no public exploit code and no CISA KEV listing were identified in the supplied intelligence.	MEDIUM	5.3	–	26	No patch

CVE-2026-78069

Missing authorization in J2Store, the J2Commerce e-commerce extension for Joomla, lets remote attackers reach the `J2StoreControllerApps` `appTask` delegation path - which instantiates app-plugin controllers with no ACL check - and drive `applocalizationdata::getInstallerTool()` with a caller-influenced, non-allow-listed table name to truncate `#__j2store_*` tables and construct a path-traversal-capable path to SQL files it then executes. This yields a file-read/execute primitive affecting J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, and 4.1.0-4.1.6. There is no public exploit identified at time of analysis, and access is currently blocked only as an accidental side effect of an `fof.xml` wildcard-deny rather than a deliberate control.

CRITICAL

9.5

0.2%

48

No patch

CVE-2026-78064

Cart-record tampering in J2Store (Joomla e-commerce extension by j2commerce.com) affects all versions across the 1.0.0-3.3.21, 4.0.0-4.0.21, and 4.1.0-4.1.6 release lines via an unoverridden inherited FOF framework `save` task reachable by unauthenticated front-end requests. The controller correctly restricted `remove()` to the caller's own session but never overrode the generic FOF `save` task, leaving it exposed to unauthenticated `format=raw` POST requests that can insert new cart rows with attacker-chosen `user_id`/`session_id` values or overwrite existing rows by numeric ID. No public exploit has been identified at time of analysis, but the zero-authentication, low-complexity network vector makes this trivially exploitable against any publicly reachable J2Store storefront.

HIGH

8.8

0.2%

44

No patch

CVE-2026-67359

Order content disclosure in J2Store (Joomla e-commerce extension by j2commerce.com) versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5 allows any unauthenticated visitor to read the full checkout confirmation of arbitrary orders - including line items, prices, and totals - by supplying a controlled order_id query parameter, with no authentication required. This is a textbook CWE-639 Insecure Direct Object Reference flaw: the application fails to verify that the requesting party owns or is authorized to view the referenced order record. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivially low exploitation barrier (unauthenticated, network-accessible, likely sequential order IDs) makes this a high-priority remediation target for any J2Store deployment handling customer order data.

HIGH

8.7

0.3%

44

No patch

CVE-2026-77999

Unauthenticated PayPal IPN callback forgery in J2Store (Joomla e-commerce extension) versions 1.0.0-3.3.21, 4.0.0-4.0.21, and 4.1.0-4.1.6 allows any anonymous attacker to confirm orders without payment or force other customers' orders to FAILED status. The vulnerability stems from three compounding flaws: a signature verification function that treated UNVERIFIED as acceptable, disabled TLS peer verification on the outbound PayPal check, and amount validation that could be entirely bypassed by omitting the mc_gross field - making the IPN endpoint trivially forgeable with a plain unauthenticated HTTP POST. No public exploit has been identified at time of analysis, but the attack is trivially constructable from the description alone given enumerable order IDs and a merchant receiver_email that is typically public.

HIGH

8.7

0.3%

44

No patch

CVE-2026-81567

Unauthenticated blind SQL injection in the J2Store e-commerce extension for Joomla allows remote attackers to extract arbitrary database contents — including customer records, order data, and stored credentials or tokens — from any publicly reachable storefront that exposes the standard product listing or product-tags filter. Affected builds span the 1.x, 3.x, 4.0.x and 4.1.x lines (1.0.0–3.3.2, 4.0.0–4.0.22, 4.1.0–4.1.7), and the CVSS 4.0 vector indicates network-reachable exploitation with no authentication and no user interaction (PR:N/UI:N) for a high confidentiality impact. No public exploit code, EPSS score, or CISA KEV entry was supplied in the intelligence feed, so active exploitation is currently unconfirmed.

HIGH

8.7

–

44

No patch

CVE-2026-81568

An arbitrary file read flaw in the J2Store e-commerce extension for Joomla (versions 1.0.0–3.3.2, 4.0.0–4.0.22 and 4.1.0–4.1.7) lets anyone holding a valid download token/pid pair for a product download retrieve files outside the configured attachment folder. The J2StoreModelOrderdownloads::getFilePath() routine builds the on-disk path by concatenating the attachments directory with the stored product_file_save_name and only runs JPath::clean() plus JFile::exists(), so a ../ segment in that stored value resolves outside the folder and exposes files such as configuration.php to the web server's read permissions. No public exploit code and no CISA KEV listing were identified at time of analysis, but a CVSS 4.0 base score of 8.7 (VC:H, AV:N, PR:N) makes this a serious confidentiality risk for exposed J2Store storefronts.

HIGH

8.7

–

44

No patch

CVE-2026-82189

Unauthenticated order-state tampering in the J2Store e-commerce extension for Joomla (versions 1.0.0–3.3.2, 4.0.0–4.0.22, and 4.1.0–4.1.7) lets anyone mark any order as FAILED without supplying a payment amount, transaction ID, or any other verification data. An attacker can mass-fail pending orders to disrupt revenue, or flip already-fulfilled orders back to FAILED, triggering unwarranted refunds, cancellations, and customer-support load. The CVE carries a CVSS 4.0 score of 8.7 driven entirely by high integrity impact; no public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis.

HIGH

8.7

–

44

No patch

CVE-2026-74252

Stored Cross-Site Scripting in J2Store and J2Commerce allows unauthenticated attackers to inject persistent malicious scripts via guest checkout billing address fields, affecting all versions from 1.0.0 through 4.1.5. The exploit abuses an interaction between Joomla's Input::getArray() sanitization and PHP's default variables_order=EGPCS setting, where Cookie values silently override POST parameters in $_REQUEST, allowing unsanitized HTML to persist in fields such as billing_first_name. When a privileged user such as a store administrator subsequently views the affected order record, the stored payload executes in their browser session. No public exploit code or CISA KEV listing has been identified at time of analysis.

HIGH

8.6

0.3%

43

No patch

CVE-2026-78065

Guest checkout address IDOR in J2Store Joomla extension exposes personally identifiable information of guest purchasers to any authenticated site user. The `editAddress()` function's ownership guard only fires when the address row carries a non-empty `user_id`; guest-checkout rows have a null `user_id`, silently bypassing the check. Any registered Joomla account can iterate sequential `address_id` integers to retrieve full name, street address, and phone number for all guest orders across J2Store versions 1.0.0 through 3.3.21, 4.0.0 through 4.0.21, and 4.1.0 through 4.1.6. No public exploit has been identified at time of analysis, but the attack is trivially simple for any authenticated user.

HIGH

7.1

0.2%

36

No patch

CVE-2026-78081

Cross-site request forgery in the J2Store e-commerce extension for Joomla (versions 1.0.0–3.3.2, 4.0.0–4.0.22 and 4.1.0–4.1.7) allows an attacker to silently overwrite a shopper's billing or shipping address while their checkout session is active, potentially redirecting a paid order to an attacker-controlled address. The cart, checkout and myprofile controllers omit CSRF token validation, so each forged request executes only with the victim's own session privileges — there is no cross-account data access. No public exploit code or active exploitation has been identified at time of analysis.

HIGH

7.1

–

36

No patch

CVE-2026-67361

Unauthenticated file upload in J2Store (Joomla e-commerce extension) versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5 permits any remote visitor to POST arbitrary files to the upload endpoint without authentication or CSRF validation. A compounding installer manifest defect omits .htaccess and web.config protection for the upload and invoices directories on fresh installs, making uploaded files directly web-accessible over HTTP. The provided CVSS 4.0 vector includes E:A (Exploit Maturity: Attacked), indicating active exploitation is confirmed at the scoring level, though no corresponding CISA KEV entry was present in the supplied intelligence data.

MEDIUM

6.9

0.2%

35

No patch

CVE-2026-67360

Cross-customer order replication in J2Store (Joomla extension by j2commerce.com, versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5) allows an authenticated attacker to supply an arbitrary order_id and copy another customer's cart contents and shipping address data directly into the attacker's own session. The root cause is absent ownership validation on the order copy function - CSRF tokens are checked, preventing cross-site request forgery, but the back-end never verifies that the order_id belongs to the requesting user. No public exploit code and no CISA KEV listing have been identified at time of analysis.

MEDIUM

6.3

0.2%

32

No patch

CVE-2026-67358

Download quota manipulation in J2Store versions 1.0.0 through 4.1.5 for Joomla allows authenticated users to increment download limit counters on digital product orders they do not own, undermining purchased access controls for other customers. The flaw is an Insecure Direct Object Reference (IDOR) in the download counter endpoint, which accepts a user-supplied order record identifier without verifying ownership against the authenticated session's order token; the same endpoint also lacks CSRF token validation, widening the attack surface. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

MEDIUM

5.3

0.1%

27

No patch

CVE-2026-78000

Reflected XSS and open-redirect flaws in J2Store, a Joomla e-commerce extension by j2commerce.com, allow unauthenticated network attackers to inject malicious scripts into victim browsers via the `filter_tag`, `pricefrom`, and `priceto` parameters across all 3.x releases through 3.3.21 and all 4.x releases through 4.1.6. Four task handlers additionally accept base64-encoded redirect URLs without destination-host validation, enabling phishing attacks that abuse the shop's trusted domain to mislead customers into visiting attacker-controlled sites. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

MEDIUM

5.3

0.3%

26

No patch

CVE-2026-82191

Parameter smuggling into the PayPal notify redirect of the J2Store extension for Joomla (versions 1.0.0-3.3.2, 4.0.0-4.0.22, and 4.1.0-4.1.7) lets an attacker-chosen query string ride along with the redirect that the notify endpoint issues to com_j2store's checkout controller, instead of the intended fixed parameter set. A victim must load the crafted link (UI:P in the CVSS 4.0 vector), after which the follow-up request to the checkout controller is processed with the injected view/task/paction parameters, giving a limited integrity impact (VI:L) with no confidentiality or availability loss. The vendor's own description concedes this does not grant an unauthenticated attacker anything they could not obtain by calling the same com_j2store URL directly; no public exploit code and no CISA KEV listing were identified in the supplied intelligence.

MEDIUM

5.3

–

26

No patch

Severity Breakdown

Monthly CVE Trend

Affected Products (3)

Top Risky CVEs