HighCVE-2026-67358CVE-2026-67359CVE-2026-67360CVE-2026-67361CVE-2026-67362CVE-2026-74252CVE-2020-139962026-08-21
Affected versions: < 3.3.21
Full advisory: www.j2commerce.com · our disclosure post
CVE-2026-67358MediumCVSS 5.3CVE published 21 August 2026Added to mySites.guru 21 August 2026
J2Store / J2Commerce (com_j2store) below 3.3.21 (Joomla 3 branch) - Unauthenticated File Upload (exploited in the wild), Order Data Disclosure, Stored XSS and IDOR (6 CVEs)
J2Store on the Joomla 3 branch before 3.3.21 is affected by six vulnerabilities in com_j2store, disclosed and fixed by J2Commerce on 20 August 2026. CVE-2026-67361 (CVSS 6.9): the cart file-upload endpoint (view=carts, task=upload) accepted POST requests from unauthenticated visitors with no CSRF token, and the installer manifest omitted media/j2store/uploads/ and media/j2store/invoices/ from its media section, so fresh installs created those folders without their .htaccess and web.config protection and uploaded files were directly reachable by URL. The vendor confirms this was EXPLOITED IN THE WILD before the fix shipped. Joomla's MediaHelper::canUpload() blocked .php, so remote code execution was not achieved, but arbitrary images, PDFs, CSVs and documents could be written and then retrieved publicly. CVE-2026-67359 (CVSS 8.7): an unauthenticated visitor could pass any order_id to view=checkout, task=expressconfirm and render another customer's full express-checkout confirmation page, including line items, quantities, prices and totals. CVE-2026-74252 (CVSS 8.6): unauthenticated stored XSS through the guest checkout billing address fields, via a filter bypass in Joomla's Input::getArray() combined with PHP variables_order=EGPCS letting a cookie override POST in $_REQUEST; the payload fires in the administrator order management panel. CVE-2026-67360 (CVSS 6.3): an authenticated user who obtained another customer's order_id could call view=myprofile, task=reOrder and copy that customer's cart contents, product options and billing/shipping address IDs into their own session; the CSRF token was checked but ownership was not. CVE-2026-67358 (CVSS 5.3): a user holding a valid order token could increment the download limit counter on a download record belonging to a different order, and the endpoint had no CSRF token. CVE-2026-67362 (CVSS 5.1): four cart task handlers (setcurrency, addItem, applyCoupon, applyVoucher) decoded a base64 URL supplied by the user and redirected to it with no host validation, enabling phishing from the shop's own trusted domain, unauthenticated. FIX: update to 3.3.21 on this Joomla 3 branch (the equivalent fixes are 4.0.21 on 4.0.x and 4.1.6 on 4.1.x). J2Commerce 6 is a separate rewritten codebase and is not affected. Because the upload flaw was exploited in the wild, also review media/j2store/uploads/ and the older media/com_j2store/uploads/ for files you do not recognise: the 3.3.21 installer scans and lists them but deliberately deletes nothing. Versions below 3.3.13 are additionally affected by CVE-2020-13996, an authenticated Store Manager SQL injection; updating to 3.3.21 resolves that as well. UPDATE, 31 August 2026: a further five vulnerabilities (CVE-2026-77999, CVE-2026-78000, CVE-2026-78064, CVE-2026-78065 and CVE-2026-78069, up to CVSS 9.4 Critical) affect every build below 3.3.22, so 3.3.21 is no longer a sufficient fix. Update to 3.3.22.
Is my site affected?
CVE-2026-67358 is checked by 3 rules. Find the extension and release line your site runs:
| Extension | Affected versions | Fixed in | What to do |
|---|---|---|---|
| J2Store / J2Commerce | before 3.3.21 | 3.3.21 | Update J2Store / J2Commerce to 3.3.21 for this flaw, or to 4.1.8 or later, which no rule we check matches. |
| J2Store / J2Commerce | from 4.0.0 up to but not including 4.0.21 | 4.0.21 | Update J2Store / J2Commerce to 4.0.21 for this flaw, or to 4.1.8 or later, which no rule we check matches. |
| J2Store / J2Commerce | from 4.1.0 up to but not including 4.1.6 | 4.1.6 | Update J2Store / J2Commerce to 4.1.6 for this flaw, or to 4.1.8 or later, which no rule we check matches. |
How CVE-2026-67358 is scored
The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.
5.3 Medium
CVSS 4.0, scored by Joomla CNACVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NHow it is reached
- AV:N Attack vector
- Network. Reachable across the internet
- AC:L Attack complexity
- Low. Nothing to work around, it just works
- AT:N Attack requirements
- None. Works against any affected install
- PR:L Privileges required
- Low. Any logged-in account will do
- UI:N User interaction
- None. Nobody has to be tricked into anything
What it does to the site
- VC:N Confidentiality
- None. Nothing can be read
- VI:L Integrity
- Low. Some data can be altered
- VA:N Availability
- None. The site stays up
What it does beyond the site
- SC:N Confidentiality
- None. Other systems keep their data
- SI:N Integrity
- None. Other systems keep their integrity
- SA:N Availability
- None. Other systems stay up
The rule below is rated High for the set of 7 CVEs it covers together, not for this record on its own.
Timeline
- 21 August 2026CVE-2026-67358 record published by its CNA
- 21 August 2026mySites.guru check added for J2Store / J2Commerce (before 3.3.21)
- 21 August 2026mySites.guru check added for J2Store / J2Commerce (from 4.0.0 up to but not including 4.0.21)
- 21 August 2026mySites.guru check added for J2Store / J2Commerce (from 4.1.0 up to but not including 4.1.6)
- 1 September 2026We published: J2Store 3.3.22, 4.0.22 and 4.1.7 fix five flaws we reported
Rule details
J2Store / J2Commerce - J2Store / J2Commerce (com_j2store) 4.0.0 to 4.0.20 - Unauthenticated File Upload (exploited in the wild), Order Data Disclosure, Stored XSS and IDOR (6 CVEs)
J2Store / J2Commerce 4.0.x before 4.0.21 is affected by six vulnerabilities in com_j2store, disclosed and fixed by J2Commerce on 20 August 2026. CVE-2026-67361 (CVSS 6.9): the cart file-upload endpoint (view=carts, task=upload) accepted POST requests from unauthenticated visitors with no CSRF token, and the installer manifest omitted media/j2store/uploads/ and media/j2store/invoices/ from its media section, so fresh installs created those folders without their .htaccess and web.config protection and uploaded files were directly reachable by URL. The vendor confirms this was EXPLOITED IN THE WILD before the fix shipped. Joomla's MediaHelper::canUpload() blocked .php, so remote code execution was not achieved, but arbitrary images, PDFs, CSVs and documents could be written and then retrieved publicly. CVE-2026-67359 (CVSS 8.7): an unauthenticated visitor could pass any order_id to view=checkout, task=expressconfirm and render another customer's full express-checkout confirmation page, including line items, quantities, prices and totals. CVE-2026-74252 (CVSS 8.6): unauthenticated stored XSS through the guest checkout billing address fields, via a filter bypass in Joomla's Input::getArray() combined with PHP variables_order=EGPCS letting a cookie override POST in $_REQUEST; the payload fires in the administrator order management panel. CVE-2026-67360 (CVSS 6.3): an authenticated user who obtained another customer's order_id could call view=myprofile, task=reOrder and copy that customer's cart contents, product options and billing/shipping address IDs into their own session; the CSRF token was checked but ownership was not. CVE-2026-67358 (CVSS 5.3): a user holding a valid order token could increment the download limit counter on a download record belonging to a different order, and the endpoint had no CSRF token. CVE-2026-67362 (CVSS 5.1): four cart task handlers (setcurrency, addItem, applyCoupon, applyVoucher) decoded a base64 URL supplied by the user and redirected to it with no host validation, enabling phishing from the shop's own trusted domain, unauthenticated. FIX: update to 4.0.21 on this 4.0.x branch (the equivalent fixes are 3.3.21 on the Joomla 3 branch and 4.1.6 on 4.1.x). J2Commerce 6 is a separate rewritten codebase and is not affected. Because the upload flaw was exploited in the wild, also review media/j2store/uploads/ and the older media/com_j2store/uploads/ for files you do not recognise: the 4.0.21 installer scans and lists them but deliberately deletes nothing. UPDATE, 31 August 2026: a further five vulnerabilities (CVE-2026-77999, CVE-2026-78000, CVE-2026-78064, CVE-2026-78065 and CVE-2026-78069, up to CVSS 9.4 Critical) affect every build below 4.0.22, so 4.0.21 is no longer a sufficient fix. Update to 4.0.22.
Affected versions: ≥ 4.0.0 and < 4.0.21
Full advisory: www.j2commerce.com · our disclosure post
J2Store / J2Commerce - J2Store / J2Commerce (com_j2store) 4.1.0 to 4.1.5 - Unauthenticated File Upload (exploited in the wild), Order Data Disclosure, Stored XSS and IDOR (6 CVEs)
J2Store / J2Commerce 4.1.x before 4.1.6 is affected by six vulnerabilities in com_j2store, disclosed and fixed by J2Commerce on 20 August 2026. CVE-2026-67361 (CVSS 6.9): the cart file-upload endpoint (view=carts, task=upload) accepted POST requests from unauthenticated visitors with no CSRF token, and the installer manifest omitted media/j2store/uploads/ and media/j2store/invoices/ from its media section, so fresh installs created those folders without their .htaccess and web.config protection and uploaded files were directly reachable by URL. The vendor confirms this was EXPLOITED IN THE WILD before the fix shipped. Joomla's MediaHelper::canUpload() blocked .php, so remote code execution was not achieved, but arbitrary images, PDFs, CSVs and documents could be written and then retrieved publicly. CVE-2026-67359 (CVSS 8.7): an unauthenticated visitor could pass any order_id to view=checkout, task=expressconfirm and render another customer's full express-checkout confirmation page, including line items, quantities, prices and totals. CVE-2026-74252 (CVSS 8.6): unauthenticated stored XSS through the guest checkout billing address fields, via a filter bypass in Joomla's Input::getArray() combined with PHP variables_order=EGPCS letting a cookie override POST in $_REQUEST; the payload fires in the administrator order management panel. CVE-2026-67360 (CVSS 6.3): an authenticated user who obtained another customer's order_id could call view=myprofile, task=reOrder and copy that customer's cart contents, product options and billing/shipping address IDs into their own session; the CSRF token was checked but ownership was not. CVE-2026-67358 (CVSS 5.3): a user holding a valid order token could increment the download limit counter on a download record belonging to a different order, and the endpoint had no CSRF token. CVE-2026-67362 (CVSS 5.1): four cart task handlers (setcurrency, addItem, applyCoupon, applyVoucher) decoded a base64 URL supplied by the user and redirected to it with no host validation, enabling phishing from the shop's own trusted domain, unauthenticated. FIX: update to 4.1.6 on this 4.1.x branch (the equivalent fixes are 3.3.21 on the Joomla 3 branch and 4.0.21 on 4.0.x). J2Commerce 6 is a separate rewritten codebase and is not affected. Because the upload flaw was exploited in the wild, also review media/j2store/uploads/ and the older media/com_j2store/uploads/ for files you do not recognise: the 4.1.6 installer scans and lists them but deliberately deletes nothing. UPDATE, 31 August 2026: a further five vulnerabilities (CVE-2026-77999, CVE-2026-78000, CVE-2026-78064, CVE-2026-78065 and CVE-2026-78069, up to CVSS 9.4 Critical) affect every build below 4.1.7, so 4.1.6 is no longer a sufficient fix. Update to 4.1.7.
Affected versions: ≥ 4.1.0 and < 4.1.6
Full advisory: www.j2commerce.com · our disclosure post
Our disclosure post
Other vulnerabilities in J2Store / J2Commerce
Updating for CVE-2026-67358 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.
J2Store / J2Commerce
Latest safe version: 4.1.8
- CVE-2026-77999 Critical, from 3.3.21 up to but not including 3.3.22
- CVE-2026-78000 Critical, from 3.3.21 up to but not including 3.3.22
- CVE-2026-78064 Critical, from 3.3.21 up to but not including 3.3.22
- CVE-2026-78065 Critical, from 3.3.21 up to but not including 3.3.22
- CVE-2026-78069 Critical, from 3.3.21 up to but not including 3.3.22
- CVE-2026-78081 High, from 3.3.22 up to but not including 3.3.23
- CVE-2026-81567 High, from 3.3.22 up to but not including 3.3.23
- CVE-2026-81568 High, from 3.3.22 up to but not including 3.3.23
References
- CVE-2026-67358 on cve.org (the official CVE record)
- CVE-2026-67358 in the NIST National Vulnerability Database
- j2commerce.com/blog/security-announcement-releases-3-3-21-4-0-21-and-4
- J2Store 3.3.22, 4.0.22 and 4.1.7 fix five flaws we reported
CVE-2026-67358 questions
Which versions are affected by CVE-2026-67358?
CVE-2026-67358 is covered by 3 rules: J2Store / J2Commerce before 3.3.21; J2Store / J2Commerce from 4.0.0 up to but not including 4.0.21; J2Store / J2Commerce from 4.1.0 up to but not including 4.1.6.
How do I fix CVE-2026-67358?
It depends on the extension and release line your site runs. For J2Store / J2Commerce before 3.3.21: update J2Store / J2Commerce to 3.3.21 for this flaw, or to 4.1.8 or later, which no rule we check matches. For J2Store / J2Commerce from 4.0.0 up to but not including 4.0.21: update J2Store / J2Commerce to 4.0.21 for this flaw, or to 4.1.8 or later, which no rule we check matches. For J2Store / J2Commerce from 4.1.0 up to but not including 4.1.6: update J2Store / J2Commerce to 4.1.6 for this flaw, or to 4.1.8 or later, which no rule we check matches.
How severe is CVE-2026-67358?
Joomla CNA scores it 5.3 (Medium) under CVSS 4.0. In plain terms: reachable across the internet, any logged-in account will do and nobody has to be tricked into anything.
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.
Rules current as of 22 October 2026.