J2Store / J2Commerce (com_j2store) below 3.3.21 (Joomla 3 branch) - Unauthenticated File Upload (exploited in the wild), Order Data Disclosure, Stored XSS and IDOR (6 CVEs)

J2Store / J2Commerce

Affected versions: < 3.3.21

Full advisory: www.j2commerce.com · our disclosure post

J2Store / J2Commerce - J2Store / J2Commerce (com_j2store) 4.0.0 to 4.0.20 - Unauthenticated File Upload (exploited in the wild), Order Data Disclosure, Stored XSS and IDOR (6 CVEs)

J2Store / J2Commerce 4.0.x before 4.0.21 is affected by six vulnerabilities in com_j2store, disclosed and fixed by J2Commerce on 20 August 2026. CVE-2026-67361 (CVSS 6.9): the cart file-upload endpoint (view=carts, task=upload) accepted POST requests from unauthenticated visitors with no CSRF token, and the installer manifest omitted media/j2store/uploads/ and media/j2store/invoices/ from its media section, so fresh installs created those folders without their .htaccess and web.config protection and uploaded files were directly reachable by URL. The vendor confirms this was EXPLOITED IN THE WILD before the fix shipped. Joomla's MediaHelper::canUpload() blocked .php, so remote code execution was not achieved, but arbitrary images, PDFs, CSVs and documents could be written and then retrieved publicly. CVE-2026-67359 (CVSS 8.7): an unauthenticated visitor could pass any order_id to view=checkout, task=expressconfirm and render another customer's full express-checkout confirmation page, including line items, quantities, prices and totals. CVE-2026-74252 (CVSS 8.6): unauthenticated stored XSS through the guest checkout billing address fields, via a filter bypass in Joomla's Input::getArray() combined with PHP variables_order=EGPCS letting a cookie override POST in $_REQUEST; the payload fires in the administrator order management panel. CVE-2026-67360 (CVSS 6.3): an authenticated user who obtained another customer's order_id could call view=myprofile, task=reOrder and copy that customer's cart contents, product options and billing/shipping address IDs into their own session; the CSRF token was checked but ownership was not. CVE-2026-67358 (CVSS 5.3): a user holding a valid order token could increment the download limit counter on a download record belonging to a different order, and the endpoint had no CSRF token. CVE-2026-67362 (CVSS 5.1): four cart task handlers (setcurrency, addItem, applyCoupon, applyVoucher) decoded a base64 URL supplied by the user and redirected to it with no host validation, enabling phishing from the shop's own trusted domain, unauthenticated. FIX: update to 4.0.21 on this 4.0.x branch (the equivalent fixes are 3.3.21 on the Joomla 3 branch and 4.1.6 on 4.1.x). J2Commerce 6 is a separate rewritten codebase and is not affected. Because the upload flaw was exploited in the wild, also review media/j2store/uploads/ and the older media/com_j2store/uploads/ for files you do not recognise: the 4.0.21 installer scans and lists them but deliberately deletes nothing. UPDATE, 31 August 2026: a further five vulnerabilities (CVE-2026-77999, CVE-2026-78000, CVE-2026-78064, CVE-2026-78065 and CVE-2026-78069, up to CVSS 9.4 Critical) affect every build below 4.0.22, so 4.0.21 is no longer a sufficient fix. Update to 4.0.22.

Affected versions: ≥ 4.0.0 and < 4.0.21

Full advisory: www.j2commerce.com · our disclosure post

J2Store / J2Commerce - J2Store / J2Commerce (com_j2store) 4.1.0 to 4.1.5 - Unauthenticated File Upload (exploited in the wild), Order Data Disclosure, Stored XSS and IDOR (6 CVEs)

J2Store / J2Commerce 4.1.x before 4.1.6 is affected by six vulnerabilities in com_j2store, disclosed and fixed by J2Commerce on 20 August 2026. CVE-2026-67361 (CVSS 6.9): the cart file-upload endpoint (view=carts, task=upload) accepted POST requests from unauthenticated visitors with no CSRF token, and the installer manifest omitted media/j2store/uploads/ and media/j2store/invoices/ from its media section, so fresh installs created those folders without their .htaccess and web.config protection and uploaded files were directly reachable by URL. The vendor confirms this was EXPLOITED IN THE WILD before the fix shipped. Joomla's MediaHelper::canUpload() blocked .php, so remote code execution was not achieved, but arbitrary images, PDFs, CSVs and documents could be written and then retrieved publicly. CVE-2026-67359 (CVSS 8.7): an unauthenticated visitor could pass any order_id to view=checkout, task=expressconfirm and render another customer's full express-checkout confirmation page, including line items, quantities, prices and totals. CVE-2026-74252 (CVSS 8.6): unauthenticated stored XSS through the guest checkout billing address fields, via a filter bypass in Joomla's Input::getArray() combined with PHP variables_order=EGPCS letting a cookie override POST in $_REQUEST; the payload fires in the administrator order management panel. CVE-2026-67360 (CVSS 6.3): an authenticated user who obtained another customer's order_id could call view=myprofile, task=reOrder and copy that customer's cart contents, product options and billing/shipping address IDs into their own session; the CSRF token was checked but ownership was not. CVE-2026-67358 (CVSS 5.3): a user holding a valid order token could increment the download limit counter on a download record belonging to a different order, and the endpoint had no CSRF token. CVE-2026-67362 (CVSS 5.1): four cart task handlers (setcurrency, addItem, applyCoupon, applyVoucher) decoded a base64 URL supplied by the user and redirected to it with no host validation, enabling phishing from the shop's own trusted domain, unauthenticated. FIX: update to 4.1.6 on this 4.1.x branch (the equivalent fixes are 3.3.21 on the Joomla 3 branch and 4.0.21 on 4.0.x). J2Commerce 6 is a separate rewritten codebase and is not affected. Because the upload flaw was exploited in the wild, also review media/j2store/uploads/ and the older media/com_j2store/uploads/ for files you do not recognise: the 4.1.6 installer scans and lists them but deliberately deletes nothing. UPDATE, 31 August 2026: a further five vulnerabilities (CVE-2026-77999, CVE-2026-78000, CVE-2026-78064, CVE-2026-78065 and CVE-2026-78069, up to CVSS 9.4 Critical) affect every build below 4.1.7, so 4.1.6 is no longer a sufficient fix. Update to 4.1.7.

Affected versions: ≥ 4.1.0 and < 4.1.6

Full advisory: www.j2commerce.com · our disclosure post