Skip to main content
mySites.guru
Free Audit
CriticalA PHP security release fixes two CVSS 9.2 flaws, and PHP 8.1 and older get no patchWhat it means for your site
CVE-2020-13996HighCVE published 9 June 2020Added to mySites.guru 21 August 2026

J2Store / J2Commerce (com_j2store) below 3.3.21 (Joomla 3 branch) - Unauthenticated File Upload (exploited in the wild), Order Data Disclosure, Stored XSS and IDOR (6 CVEs)

J2Store on the Joomla 3 branch before 3.3.21 is affected by six vulnerabilities in com_j2store, disclosed and fixed by J2Commerce on 20 August 2026. CVE-2026-67361 (CVSS 6.9): the cart file-upload endpoint (view=carts, task=upload) accepted POST requests from unauthenticated visitors with no CSRF token, and the installer manifest omitted media/j2store/uploads/ and media/j2store/invoices/ from its media section, so fresh installs created those folders without their .htaccess and web.config protection and uploaded files were directly reachable by URL. The vendor confirms this was EXPLOITED IN THE WILD before the fix shipped. Joomla's MediaHelper::canUpload() blocked .php, so remote code execution was not achieved, but arbitrary images, PDFs, CSVs and documents could be written and then retrieved publicly. CVE-2026-67359 (CVSS 8.7): an unauthenticated visitor could pass any order_id to view=checkout, task=expressconfirm and render another customer's full express-checkout confirmation page, including line items, quantities, prices and totals. CVE-2026-74252 (CVSS 8.6): unauthenticated stored XSS through the guest checkout billing address fields, via a filter bypass in Joomla's Input::getArray() combined with PHP variables_order=EGPCS letting a cookie override POST in $_REQUEST; the payload fires in the administrator order management panel. CVE-2026-67360 (CVSS 6.3): an authenticated user who obtained another customer's order_id could call view=myprofile, task=reOrder and copy that customer's cart contents, product options and billing/shipping address IDs into their own session; the CSRF token was checked but ownership was not. CVE-2026-67358 (CVSS 5.3): a user holding a valid order token could increment the download limit counter on a download record belonging to a different order, and the endpoint had no CSRF token. CVE-2026-67362 (CVSS 5.1): four cart task handlers (setcurrency, addItem, applyCoupon, applyVoucher) decoded a base64 URL supplied by the user and redirected to it with no host validation, enabling phishing from the shop's own trusted domain, unauthenticated. FIX: update to 3.3.21 on this Joomla 3 branch (the equivalent fixes are 4.0.21 on 4.0.x and 4.1.6 on 4.1.x). J2Commerce 6 is a separate rewritten codebase and is not affected. Because the upload flaw was exploited in the wild, also review media/j2store/uploads/ and the older media/com_j2store/uploads/ for files you do not recognise: the 3.3.21 installer scans and lists them but deliberately deletes nothing. Versions below 3.3.13 are additionally affected by CVE-2020-13996, an authenticated Store Manager SQL injection; updating to 3.3.21 resolves that as well. UPDATE, 31 August 2026: a further five vulnerabilities (CVE-2026-77999, CVE-2026-78000, CVE-2026-78064, CVE-2026-78065 and CVE-2026-78069, up to CVSS 9.4 Critical) affect every build below 3.3.22, so 3.3.21 is no longer a sufficient fix. Update to 3.3.22.

Is my site affected?

Affected
J2Store / J2Commerce before 3.3.21
Fixed in
3.3.21
What to do
Update J2Store / J2Commerce to 3.3.21 for this flaw, or to 4.1.8 or later, which no rule we check matches.
Check whether your sites are affected

How severe CVE-2020-13996 is

The published CVE record has no CVSS score, so there is no vector to break down here. mySites.guru rates it High, and that is the rating your sites are checked against.

Timeline

  1. 9 June 2020CVE-2020-13996 record published by its CNA
  2. 21 August 2026mySites.guru check added for J2Store / J2Commerce (before 3.3.21)
  3. 1 September 2026We published: J2Store 3.3.22, 4.0.22 and 4.1.7 fix five flaws we reported

Rule details

Our disclosure post

J2Store 3.3.22, 4.0.22 and 4.1.7 fix five flaws we reported

J2Store 3.3.22, 4.0.22 and 4.1.7 fix five flaws we reported

J2Store 3.3.22, 4.0.22 and 4.1.7 fix five flaws mySites.guru reported, including anonymous PayPal order confirmation and a 9.5 backend escalation.

Other vulnerabilities in J2Store / J2Commerce

Updating for CVE-2020-13996 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.

J2Store / J2Commerce

Latest safe version: 4.1.8

All 18 CVEs in J2Store / J2Commerce

References

CVE-2020-13996 questions

Which versions are affected by CVE-2020-13996?
CVE-2020-13996 affects J2Store / J2Commerce before 3.3.21. The fix is in 3.3.21.
How do I fix CVE-2020-13996?
Update J2Store / J2Commerce to 3.3.21 for this flaw, or to 4.1.8 or later, which no rule we check matches. Then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
How severe is CVE-2020-13996?
The published CVE record has no CVSS score. mySites.guru rates it High.

Running an affected version on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.

Rules current as of 22 October 2026.