J2Store 3 Stops Getting Security Fixes on 19 October 2026

J2Commerce put a date on it on 3 September 2026. On 19 October 2026, two years to the day after they took the J2Store Joomla extension over, the 3.x line stops. No security patches, including for anything found after that date, no support requests answered, no further releases of any kind.

Six in ten of the J2Store installs we can see are on that line.

J2Commerce is drawing a line under the version most of their own users are still running, which is uncomfortable precisely because it is the right call.

What J2Commerce announced, and what end of life means here

The announcement sets out a full roadmap rather than a single cutoff, which is worth reading as a piece of policy rather than as news.

J2Commerce took over J2Store on 19 October 2024, after the original team closed the project citing rising costs and falling revenue. Every release since then has shipped a documented migration path to J2Store 4 alongside it. Two years was the runway they set themselves, and 19 October 2026 is the end of it.

From that date, J2Store 3 gets nothing. The vendor is explicit that this includes security patches for issues discovered afterwards, which is the part that matters, and that no support requests will be answered for the 3.x line.

They have also set a date for the version they are telling everyone to move to. J2Store 4, now branded J2Commerce 4, reaches end of life on 19 October 2027. From here on, their support tracks Joomla’s own major-version cadence one step behind, with a fixed runway rather than a judgement call each time.

What the J2Store installs we monitor actually look like

Every write-up of an end-of-life announcement says some version of “many sites are still affected”. We can put a number on it, because each Joomla site connected to mySites.guru reports its installed extensions and their versions on its regular snapshot.

The third figure is the one that should worry a shop owner more than the deadline does. Three quarters of the J2Store 3 installs we can see are below 3.3.21, which means they never took the 20 August 2026 release, let alone the 31 August one. They are two advisories behind while the branch is still being maintained. Whatever happens on 19 October changes very little for a site in that state, because it has already been running as though the vendor had stopped.

J2Store is also the most Joomla-3-weighted shop extension on the platform by a wide margin. Across the carts we see, roughly 61% of J2Store installs sit on Joomla 3, against about 45% for VirtueMart, 40% for EShop, 24% for HikaShop and 9% for Phoca Cart. That is why this announcement reaches a far bigger share of live shops than the same announcement from any of the others would.

Why is J2Store 3 ending now?

Because of what it is built on, at both ends: the CMS underneath it, and the framework inside it. Joomla 3 reached end of life on 17 August 2023. After that, the only thing standing between a Joomla 3 site and an unpatched core was Joomla’s paid Extended Long Term Support programme, and that ended on 17 February 2025. The final Joomla 3 release of any kind was 3.10.20, in January 2025. For more than eighteen months there has been no version of Joomla 3 receiving core security fixes from Joomla, at any price.

J2Commerce kept patching anyway, well past that point, and the August 2026 releases are the proof: two separate security batches (20 August and 31 August) ten days apart, both shipped for the Joomla 3 branch on the same day as the modern ones. Their conclusion is that continuing to do this “does more to reassure people than to actually protect them”, which is a harder thing to say in public than most vendors manage.

The announcement stops there, but the public record shows what that patching costs. In one fortnight in August 2026 the J2Store Joomla extension took eleven CVEs across two advisories, and each advisory meant building and shipping three separate branches on the same day. Six security releases in ten days.

The architecture is what makes that expensive. J2Store is built on FOF, a framework J2Commerce’s own requirements page describes as no longer maintained and a source of PHP deprecation warnings. At least two of the five flaws we reported in August exist because of how FOF behaves rather than because of anything anyone wrote: a controller task inherited from the framework with no permission check of its own, and a framework default that reads an undeclared ACL node as permission granted. J2Commerce 6 was written without FOF at all. Keeping J2Store 3 patched means keeping that framework going on top of a CMS that is itself unmaintained, and reasoning about every fix three times, once per branch. The team that ran J2Store before J2Commerce closed the project citing rising costs and falling revenue, so the maintenance economics here are not new.

Their wording is careful and worth keeping intact: no version of Joomla 3 receives security fixes from Joomla. Third-party Joomla 3 patching does still exist, including a paid one-off patch set and a free community fork, and the community core backport, which we apply across connected Joomla 3 sites in one click, closes the published core holes without an eLTS licence. None of that helps here. Patching the core does nothing about a shop component that no longer has anyone maintaining it, and that distinction is the trap for a J2Store 3 owner who has been told their Joomla 3 sites are covered.

What actually changes on 19 October

Nothing visible. The shop keeps taking orders on 20 October exactly as it did on 18 October. That is what makes an extension end of life easy to defer and easy to get wrong.

What changes is what happens the next time somebody finds something. Two batches of flaws were found in this extension in a single fortnight in August 2026, by four separate researchers. Six on 20 August, including CVE-2026-67361, an unauthenticated file upload that the vendor confirmed had already been used against real sites before the patch shipped, and whose published CVSS vector records its exploit maturity as Attacked rather than proof-of-concept. Joomla’s own upload filter blocked PHP files, so it did not become remote code execution, which is luck rather than design.

Then five more on 31 August, which we found and reported. The worst of those, CVE-2026-78069, published on 3 September at 9.5 Critical: a missing permission check that let any account able to log into the Joomla administrator, holding no J2Store permission at all, truncate the shop’s tables and run SQL files off the disk.

Working proof-of-concept code for the 20 August batch is published on GitHub. So the question after 19 October is what a shop owner does when the next advisory arrives with no patch behind it. Eleven flaws were found in this extension in a single fortnight while people were actively looking, and there is no reason to expect the twelfth to wait politely for a supported version to appear.

The route out runs onto ground that is also running out

The documented migration is J2Store 3 to J2Store 4, and because J2Store 4 will not install on Joomla 3, that migration is also a Joomla migration. The vendor is right that the two should be planned as one project rather than two. Where their documentation needs reading carefully is the destination: it targets “the latest Joomla 4 or 5”.

Both of those are further along than they sound. Joomla 4 passed its own security end of life on 14 October 2025 and has been removed from Joomla’s live roadmap. Joomla 5 leaves bugfix support on 13 October 2026, six days before J2Store 3’s end-of-life date, and its security-only phase ends in October 2027. A shop that migrates to J2Store 4 on Joomla 5 in the next six weeks is standing on a version that stops getting bugfixes the week before the deadline it was migrating to beat.

J2Commerce 6, the current line, is a rewrite rather than an upgrade. No FOF, native Joomla 6 code, PHP 8.3 minimum, and the vendor is explicit that it does not run on Joomla 4 or Joomla 5. Reaching it from J2Store 3 means two CMS jumps and two data migrations, because the direct J2Store 3 to J2Commerce 6 tool the announcement mentions is still in development. The shipped migrators for J2Commerce 6 come from J2Commerce 4, eShop, Shopware 6, VirtueMart 3 and WooCommerce, not from J2Store 3.

None of that is an argument for staying put, but it is an argument for aiming at Joomla 6 and J2Commerce 6 as the destination and treating J2Store 4 as a staging post you pass through, rather than budgeting for the halfway house and discovering the second half a year later.

The shop is the hard case in a Joomla 3 migration

There is a reason these particular sites are still on Joomla 3 when the brochure sites moved years ago, and it is not neglect.

A shop has checkout, payment gateway credentials, shipping rules, tax rules, coupon history and years of order records that somebody may need to produce for an accountant. It usually has template overrides written against the old markup, and often a third-party payment or shipping plugin whose vendor is less responsive than J2Commerce. Testing it properly means putting a real card through a real gateway on a staging copy and then doing it again after cutover. That is a week of somebody’s attention, not an afternoon, and it needs a maintenance window on a site that takes money.

So the shop is the last thing an agency migrates, and it is the site that slips from one quarter’s plan to the next without anyone ever deciding that it should. The deadline does not care about any of that, which is the uncomfortable part of writing it down.

The vendor’s own pre-migration checklist is short and worth following exactly: take a full backup first, run the migration on a staging copy rather than the live store, audit template overrides and any third-party checkout or cart add-ons for compatibility, confirm the host meets the PHP and Joomla requirements for the version you are targeting, move through the documented path rather than skipping versions, and test checkout, shipping and payment end to end before cutting over.

One thing their checklist does not mention: J2Commerce is moving nearly 200 add-ons from free downloads back to paid subscriptions. If your shop depends on add-ons that arrived free, price that in before you commit to a date.

What about the other Joomla shop extensions?

The obvious alternative to migrating J2Store is switching cart entirely, and it is worth being honest about what that buys.

HikaShop still ships Joomla 3 builds. Its current release came out in August 2026 and its download page still lists Joomla 3, with no end-of-life statement anywhere. VirtueMart is the strongest Joomla 3 commitment in the market: its update feed still declares support for Joomla 3.0 through 3.10, and the vendor has said the next major version will run on everything from Joomla 3 to Joomla 6. VirtueMart is, however, currently unpublished from the Joomla Extensions Directory pending a review, which is its own kind of signal.

Phoca Cart is the instructive one. Its last Joomla 3 stable release was 3.5.8, in October 2021. When it shipped security releases in August 2026, they went to the Joomla 4, 5 and 6 branches with no Joomla 3 equivalent, and its product page still advertises Joomla 3 support today. There is no announcement to find, no date to plan around, and a shop owner reading the requirements would reasonably conclude they were covered.

Set against that, J2Commerce publishing a hard date fourteen months ahead of the version it applies to is the better problem. And switching cart is a data migration with a checkout rebuild attached, so it is rarely cheaper than moving forward on the cart you already know. It is not automatically safer either: we found three flaws in EasyStore, including order forgery, the last time we looked at a Joomla shop extension somebody was migrating to.

How do I find every J2Store 3 install across the sites I manage?

Doing this by hand means logging into each Joomla site, opening the extension manager and reading off a version number, which is slow enough that it gets deferred and then skipped.

mySites.guru records the installed extension inventory for every connected site, so searching the Extension Inventory in mySites.guru for J2Store returns every install with its version on a single screen, including the sites you had forgotten were running a shop at all.

Six vulnerability rules for this extension are live, one per release branch across both August advisories, so an affected site is flagged with the fix version for the branch it is actually on rather than the highest number available. That distinction matters more with J2Store than with most extensions: the three patched builds are 3.3.22, 4.0.22 and 4.1.7, and 4.1.7 sorts above the other two while being an entirely different release line that will not install on a Joomla 3 site. Any check that treats “below 4.1.7” as the rule will tell a correctly patched Joomla 3 shop that it is vulnerable.

mySites.guru also tracks end-of-life versions of Joomla and WordPress themselves, back to Joomla 1.5, so the sites with both problems at once are visible in one place rather than two.

What to do in the next six weeks

If you have J2Store 3 sites, the sequence that wastes the least time is:

1. Get the update on before you plan anything. Three quarters of the J2Store 3 installs we can see are below 3.3.21 and are missing eleven fixed vulnerabilities, one of them already used in the wild. Installing 3.3.22 takes minutes and is worth doing today whether or not you migrate by October. Install the build for the branch each site is on, not the highest number you can find.
2. Decide the destination, not just the next step. Joomla 6 with J2Commerce 6 is the version with a future. J2Store 4 on Joomla 5 is a staging post with fourteen months on the clock and a bugfix deadline of its own next week.
3. Book the work as a project with a window. Backup, staging copy, override audit, add-on compatibility check, host PHP check, end-to-end payment test, then cutover.
4. For the shops that will not make October, say so out loud. A client who knows their shop is running unmaintained software and has agreed a date to fix it is in a completely different position from one who finds out afterwards.

If one of these shops turns out to be compromised, fix.mySites.guru is a fixed fee of £120 per incident, usually same day, screened before we commit so you are not charged if it turns out not to be fixable. That is incident work and nothing else. Moving a J2Store 3 shop onto a supported line is a project many times that size, it is not something we sell, and anyone quoting you £120 to do it has not looked at your checkout.

J2Commerce did this properly

Two years of runway. A hard, public, dated announcement, published while the version being retired is still the one most of their own users run. Migration documentation shipped alongside every release since the takeover, not written the week of the announcement. Both August security batches patched on the Joomla 3 branch the same day as the modern ones, when patching only the current branch would have been cheaper and would have stranded most of their install base. And an advisory in August that named the reporter, which is still not a given.

We have documented thirty-odd vendor positions on Joomla 3, and the pattern is that the loudest announcements are the least reliable predictors of what a vendor actually does next. Vendors have announced the end of Joomla 3 support and then shipped Joomla 3 patches six days later. Others have said nothing at all for three years while shipping fixes anyway, or while stopping without a word. Against that spread, a dated roadmap with a stated policy behind it is the only version of this an agency can actually plan around.

The uncomfortable part of this announcement sits on the other side of it, with the six in ten J2Store shops still on the line being retired, three quarters of which have not applied a security release since before either August advisory. For those sites the end-of-life date is not the moment the risk starts. It is the moment the last thing that was still working in their favour stops.

One postscript, because it changes what you should watch for rather than what you should do. We are led to believe there will be at least one more J2Store 3 release before the hard cut-off on 19 October 2026. Take it when it arrives, and take it quickly: a release that close to the end of a branch is the last chance that branch has to hand you anything. It is not a reason to let the migration slip.