# J2Store / J2Commerce (com_j2store) 3.3.21 (Joomla 3 branch) - Unauthenticated Payment Callback Forgery and Cart Tampering, Backend Privilege Escalation, Guest Address IDOR and Reflected XSS (5 CVEs)

[Joomla Vulnerability Database](https://mysites.guru/vulnerabilities/)/CVE-2026-78064

CVE-2026-78064HighCVSS 8.8CVE published 3 September 2026Added to mySites.guru 31 August 2026

# J2Store / J2Commerce (com\_j2store) 3.3.21 (Joomla 3 branch) - Unauthenticated Payment Callback Forgery and Cart Tampering, Backend Privilege Escalation, Guest Address IDOR and Reflected XSS (5 CVEs)

J2Store 3.3.21 on the Joomla 3 branch is affected by five vulnerabilities in com\_j2store, disclosed by Phil Taylor (mySites.guru) and fixed by J2Commerce on 31 August 2026. CVE-2026-78069 (CVSS 9.5, Critical): the administrator Apps controller instantiates app-plugin controllers through an appTask delegation path with no com\_j2store ACL check anywhere in the code, and the backend node of fof.xml declares no view ACL at all, so FOF defaults an unmatched task to allow rather than deny. Any authenticated Joomla backend user, holding no J2Store permission whatsoever, can trigger #\_\_j2store\_\* table truncation and traversal-based SQL file execution; only the Joomla core administrator login wall keeps anonymous visitors out, and that checks nothing about com\_j2store permissions. CVE-2026-78064 (CVSS 8.8, High): the carts view inherits the generic FOF save task under a wildcard true ACL in fof.xml, and FOF enforces CSRF tokens only on backend HTML requests, not on frontend format=raw requests, so an unauthenticated POST can insert cart rows with an attacker-chosen user\_id or session\_id, or overwrite an existing row by id. CVE-2026-77999 (CVSS 8.7, High): the PayPal IPN listener treated UNVERIFIED and any non-INVALID response as valid, made its verification request with CURLOPT\_SSL\_VERIFYPEER disabled, and stored the verdict in a field nothing downstream read, so processing continued regardless of the outcome; separately, omitting mc\_gross from the POST body skipped the paid-amount comparison entirely. Unauthenticated requests could confirm orders that were never paid for, or fail legitimate ones. CVE-2026-78065 (CVSS 7.1, High): editAddress() redirected non-owners away only when the loaded address row had a non-empty user\_id, and guest checkout rows have none, so any logged-in account guessing a small sequential address\_id was shown a guest customer full name, street address and phone number prefilled into the edit form. CVE-2026-78000 (CVSS 5.3, Medium): filter\_tag, pricefrom and priceto are echoed unescaped into a hidden input value attribute by J2Html::input(), across all six shipped product-tags templates, giving reflected XSS from a crafted link with no click beyond the initial navigation. FIX: update to 3.3.22 on this Joomla 3 branch (the equivalent fixes are 4.0.22 on 4.0.x and 4.1.7 on 4.1.x). If you cannot update immediately: disable PayPal, or watch pending orders for CONFIRMED or FAILED transitions with no matching PayPal transaction; disable guest checkout; and review every Joomla backend account regardless of privilege level, because the Apps controller issue needs a backend login but no J2Store permission. All five CVE records were published by the Joomla CNA on 3 September 2026 and all five credit Phil Taylor, mySites.guru. The affected ranges are unchanged. Four scores match the vendor advisory; CVE-2026-78069 was raised from the vendor's 9.4 to 9.5 Critical, and the published vector reads AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, scoring the backend login as an attack requirement (AT:P) rather than a privilege (PR:L).

Copy citation

## Is my site affected?

CVE-2026-78064 is checked by 3 rules. Find the extension and release line your site runs:

Extension

Affected versions

Fixed in

What to do

[J2Store / J2Commerce](https://mysites.guru/vulnerabilities/j2store/)

from 3.3.21 up to but not including 3.3.22

3.3.22

Update J2Store / J2Commerce to 3.3.22 for this flaw, or to 4.1.8 or later, which no rule we check matches.

[J2Store / J2Commerce](https://mysites.guru/vulnerabilities/j2store/)

from 4.0.21 up to but not including 4.0.22

4.0.22

Update J2Store / J2Commerce to 4.0.22 for this flaw, or to 4.1.8 or later, which no rule we check matches.

[J2Store / J2Commerce](https://mysites.guru/vulnerabilities/j2store/)

from 4.1.6 up to but not including 4.1.7

4.1.7

Update J2Store / J2Commerce to 4.1.7 for this flaw, or to 4.1.8 or later, which no rule we check matches.

[Check whether your sites are affected](https://mysites.guru/free-audit/)

## How CVE-2026-78064 is scored

The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

8.8 High

CVSS 4.0, scored by Joomla CNA

`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N`

### How it is reached

- **AV:N Attack vector** - Network. Reachable across the internet
- **AC:L Attack complexity** - Low. Nothing to work around, it just works
- **AT:N Attack requirements** - None. Works against any affected install
- **PR:N Privileges required** - None. No account needed
- **UI:N User interaction** - None. Nobody has to be tricked into anything

### What it does to the site

- **VC:L Confidentiality** - Low. Some data can be read
- **VI:H Integrity** - High. Data and files can be altered at will
- **VA:N Availability** - None. The site stays up

### What it does beyond the site

- **SC:N Confidentiality** - None. Other systems keep their data
- **SI:N Integrity** - None. Other systems keep their integrity
- **SA:N Availability** - None. Other systems stay up

The rule below is rated Critical for the set of 5 CVEs it covers together, not for this record on its own.

## Timeline

1.  31 August 2026mySites.guru check added for J2Store / J2Commerce (from 3.3.21 up to but not including 3.3.22)
2.  31 August 2026mySites.guru check added for J2Store / J2Commerce (from 4.0.21 up to but not including 4.0.22)
3.  31 August 2026mySites.guru check added for J2Store / J2Commerce (from 4.1.6 up to but not including 4.1.7)
4.  1 September 2026[We published: J2Store 3.3.22, 4.0.22 and 4.1.7 fix five flaws we reported](https://mysites.guru/blog/j2store-five-security-flaws-disclosure/)
5.  3 September 2026CVE-2026-78064 record published by its CNA

## Rule details

Critical[CVE-2026-77999](https://mysites.guru/vulnerabilities/CVE-2026-77999/)[CVE-2026-78000](https://mysites.guru/vulnerabilities/CVE-2026-78000/)[CVE-2026-78064](https://mysites.guru/vulnerabilities/CVE-2026-78064/)[CVE-2026-78065](https://mysites.guru/vulnerabilities/CVE-2026-78065/)[CVE-2026-78069](https://mysites.guru/vulnerabilities/CVE-2026-78069/)2026-08-31

[J2Store / J2Commerce](https://mysites.guru/vulnerabilities/j2store/)

Affected versions: ≥ 3.3.21 and < 3.3.22

Full advisory: [our disclosure post](https://mysites.guru/blog/j2store-five-security-flaws-disclosure/) · [www.j2commerce.com](https://www.j2commerce.com/blog/security-announcement-releases-3-3-22-4-0-22-and-4-1-7)

Critical[CVE-2026-77999](https://mysites.guru/vulnerabilities/CVE-2026-77999/)[CVE-2026-78000](https://mysites.guru/vulnerabilities/CVE-2026-78000/)[CVE-2026-78064](https://mysites.guru/vulnerabilities/CVE-2026-78064/)[CVE-2026-78065](https://mysites.guru/vulnerabilities/CVE-2026-78065/)[CVE-2026-78069](https://mysites.guru/vulnerabilities/CVE-2026-78069/)2026-08-31

[J2Store / J2Commerce](https://mysites.guru/vulnerabilities/j2store/) - J2Store / J2Commerce (com\_j2store) 4.0.21 (Joomla 4.0 branch) - Unauthenticated Payment Callback Forgery and Cart Tampering, Backend Privilege Escalation, Guest Address IDOR and Reflected XSS (5 CVEs)

J2Store / J2Commerce 4.0.21 is affected by five vulnerabilities in com\_j2store, disclosed by Phil Taylor (mySites.guru) and fixed by J2Commerce on 31 August 2026. CVE-2026-78069 (CVSS 9.5, Critical): the administrator Apps controller instantiates app-plugin controllers through an appTask delegation path with no com\_j2store ACL check anywhere in the code, and the backend node of fof.xml declares no view ACL at all, so FOF defaults an unmatched task to allow rather than deny. Any authenticated Joomla backend user, holding no J2Store permission whatsoever, can trigger #\_\_j2store\_\* table truncation and traversal-based SQL file execution; only the Joomla core administrator login wall keeps anonymous visitors out, and that checks nothing about com\_j2store permissions. CVE-2026-78064 (CVSS 8.8, High): the carts view inherits the generic FOF save task under a wildcard true ACL in fof.xml, and FOF enforces CSRF tokens only on backend HTML requests, not on frontend format=raw requests, so an unauthenticated POST can insert cart rows with an attacker-chosen user\_id or session\_id, or overwrite an existing row by id. CVE-2026-77999 (CVSS 8.7, High): the PayPal IPN listener treated UNVERIFIED and any non-INVALID response as valid, made its verification request with CURLOPT\_SSL\_VERIFYPEER disabled, and stored the verdict in a field nothing downstream read, so processing continued regardless of the outcome; separately, omitting mc\_gross from the POST body skipped the paid-amount comparison entirely. Unauthenticated requests could confirm orders that were never paid for, or fail legitimate ones. CVE-2026-78065 (CVSS 7.1, High): editAddress() redirected non-owners away only when the loaded address row had a non-empty user\_id, and guest checkout rows have none, so any logged-in account guessing a small sequential address\_id was shown a guest customer full name, street address and phone number prefilled into the edit form. CVE-2026-78000 (CVSS 5.3, Medium): filter\_tag, pricefrom and priceto are echoed unescaped into a hidden input value attribute by J2Html::input(), across all six shipped product-tags templates, giving reflected XSS from a crafted link with no click beyond the initial navigation. FIX: update to 4.0.22 on this 4.0.x branch (the equivalent fixes are 3.3.22 on the Joomla 3 branch and 4.1.7 on 4.1.x). If you cannot update immediately: disable PayPal, or watch pending orders for CONFIRMED or FAILED transitions with no matching PayPal transaction; disable guest checkout; and review every Joomla backend account regardless of privilege level, because the Apps controller issue needs a backend login but no J2Store permission. All five CVE records were published by the Joomla CNA on 3 September 2026 and all five credit Phil Taylor, mySites.guru. The affected ranges are unchanged. Four scores match the vendor advisory; CVE-2026-78069 was raised from the vendor's 9.4 to 9.5 Critical, and the published vector reads AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, scoring the backend login as an attack requirement (AT:P) rather than a privilege (PR:L).

Affected versions: ≥ 4.0.21 and < 4.0.22

Full advisory: [our disclosure post](https://mysites.guru/blog/j2store-five-security-flaws-disclosure/) · [www.j2commerce.com](https://www.j2commerce.com/blog/security-announcement-releases-3-3-22-4-0-22-and-4-1-7)

Critical[CVE-2026-77999](https://mysites.guru/vulnerabilities/CVE-2026-77999/)[CVE-2026-78000](https://mysites.guru/vulnerabilities/CVE-2026-78000/)[CVE-2026-78064](https://mysites.guru/vulnerabilities/CVE-2026-78064/)[CVE-2026-78065](https://mysites.guru/vulnerabilities/CVE-2026-78065/)[CVE-2026-78069](https://mysites.guru/vulnerabilities/CVE-2026-78069/)2026-08-31

[J2Store / J2Commerce](https://mysites.guru/vulnerabilities/j2store/) - J2Store / J2Commerce (com\_j2store) 4.1.6 (Joomla 4.1 branch) - Unauthenticated Payment Callback Forgery and Cart Tampering, Backend Privilege Escalation, Guest Address IDOR and Reflected XSS (5 CVEs)

J2Store / J2Commerce 4.1.6 is affected by five vulnerabilities in com\_j2store, disclosed by Phil Taylor (mySites.guru) and fixed by J2Commerce on 31 August 2026. CVE-2026-78069 (CVSS 9.5, Critical): the administrator Apps controller instantiates app-plugin controllers through an appTask delegation path with no com\_j2store ACL check anywhere in the code, and the backend node of fof.xml declares no view ACL at all, so FOF defaults an unmatched task to allow rather than deny. Any authenticated Joomla backend user, holding no J2Store permission whatsoever, can trigger #\_\_j2store\_\* table truncation and traversal-based SQL file execution; only the Joomla core administrator login wall keeps anonymous visitors out, and that checks nothing about com\_j2store permissions. CVE-2026-78064 (CVSS 8.8, High): the carts view inherits the generic FOF save task under a wildcard true ACL in fof.xml, and FOF enforces CSRF tokens only on backend HTML requests, not on frontend format=raw requests, so an unauthenticated POST can insert cart rows with an attacker-chosen user\_id or session\_id, or overwrite an existing row by id. CVE-2026-77999 (CVSS 8.7, High): the PayPal IPN listener treated UNVERIFIED and any non-INVALID response as valid, made its verification request with CURLOPT\_SSL\_VERIFYPEER disabled, and stored the verdict in a field nothing downstream read, so processing continued regardless of the outcome; separately, omitting mc\_gross from the POST body skipped the paid-amount comparison entirely. Unauthenticated requests could confirm orders that were never paid for, or fail legitimate ones. CVE-2026-78065 (CVSS 7.1, High): editAddress() redirected non-owners away only when the loaded address row had a non-empty user\_id, and guest checkout rows have none, so any logged-in account guessing a small sequential address\_id was shown a guest customer full name, street address and phone number prefilled into the edit form. CVE-2026-78000 (CVSS 5.3, Medium): filter\_tag, pricefrom and priceto are echoed unescaped into a hidden input value attribute by J2Html::input(), across all six shipped product-tags templates, giving reflected XSS from a crafted link with no click beyond the initial navigation. FIX: update to 4.1.7 on this 4.1.x branch (the equivalent fixes are 3.3.22 on the Joomla 3 branch and 4.0.22 on 4.0.x). If you cannot update immediately: disable PayPal, or watch pending orders for CONFIRMED or FAILED transitions with no matching PayPal transaction; disable guest checkout; and review every Joomla backend account regardless of privilege level, because the Apps controller issue needs a backend login but no J2Store permission. All five CVE records were published by the Joomla CNA on 3 September 2026 and all five credit Phil Taylor, mySites.guru. The affected ranges are unchanged. Four scores match the vendor advisory; CVE-2026-78069 was raised from the vendor's 9.4 to 9.5 Critical, and the published vector reads AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, scoring the backend login as an attack requirement (AT:P) rather than a privilege (PR:L).

Affected versions: ≥ 4.1.6 and < 4.1.7

Full advisory: [our disclosure post](https://mysites.guru/blog/j2store-five-security-flaws-disclosure/) · [www.j2commerce.com](https://www.j2commerce.com/blog/security-announcement-releases-3-3-22-4-0-22-and-4-1-7)

## Our disclosure post

[![J2Store 3.3.22, 4.0.22 and 4.1.7 fix five flaws we reported](https://mysites.guru/_astro/j2store-five-security-flaws-disclosure.B-pXG9UH_1t5Wur.webp)

### J2Store 3.3.22, 4.0.22 and 4.1.7 fix five flaws we reported

J2Store 3.3.22, 4.0.22 and 4.1.7 fix five flaws mySites.guru reported, including anonymous PayPal order confirmation and a 9.5 backend escalation.

1 Sept 2026

](https://mysites.guru/blog/j2store-five-security-flaws-disclosure/)

## Other vulnerabilities in J2Store / J2Commerce

Updating for CVE-2026-78064 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.

### [J2Store / J2Commerce](https://mysites.guru/vulnerabilities/j2store/)

Latest safe version: 4.1.8

-   [CVE-2026-77999](https://mysites.guru/vulnerabilities/CVE-2026-77999/) Critical, from 3.3.21 up to but not including 3.3.22
-   [CVE-2026-78000](https://mysites.guru/vulnerabilities/CVE-2026-78000/) Critical, from 3.3.21 up to but not including 3.3.22
-   [CVE-2026-78065](https://mysites.guru/vulnerabilities/CVE-2026-78065/) Critical, from 3.3.21 up to but not including 3.3.22
-   [CVE-2026-78069](https://mysites.guru/vulnerabilities/CVE-2026-78069/) Critical, from 3.3.21 up to but not including 3.3.22
-   [CVE-2026-78081](https://mysites.guru/vulnerabilities/CVE-2026-78081/) High, from 3.3.22 up to but not including 3.3.23
-   [CVE-2026-81567](https://mysites.guru/vulnerabilities/CVE-2026-81567/) High, from 3.3.22 up to but not including 3.3.23
-   [CVE-2026-81568](https://mysites.guru/vulnerabilities/CVE-2026-81568/) High, from 3.3.22 up to but not including 3.3.23
-   [CVE-2026-82189](https://mysites.guru/vulnerabilities/CVE-2026-82189/) High, from 3.3.22 up to but not including 3.3.23

[All 18 CVEs in J2Store / J2Commerce](https://mysites.guru/vulnerabilities/j2store/)

## References

-   [CVE-2026-78064 on cve.org (the official CVE record)](https://www.cve.org/CVERecord?id=CVE-2026-78064)
-   [CVE-2026-78064 in the NIST National Vulnerability Database](https://nvd.nist.gov/vuln/detail/CVE-2026-78064)
-   [J2Store 3.3.22, 4.0.22 and 4.1.7 fix five flaws we reported](https://mysites.guru/blog/j2store-five-security-flaws-disclosure/)
-   [j2commerce.com/blog/security-announcement-releases-3-3-22-4-0-22-and-4](https://www.j2commerce.com/blog/security-announcement-releases-3-3-22-4-0-22-and-4-1-7)

## CVE-2026-78064 questions

Show all

Which versions are affected by CVE-2026-78064?

[CVE-2026-78064](https://mysites.guru/vulnerabilities/CVE-2026-78064/) is covered by 3 rules: J2Store / J2Commerce from 3.3.21 up to but not including 3.3.22; J2Store / J2Commerce from 4.0.21 up to but not including 4.0.22; J2Store / J2Commerce from 4.1.6 up to but not including 4.1.7.

How do I fix CVE-2026-78064?

It depends on the extension and release line your site runs. For J2Store / J2Commerce from 3.3.21 up to but not including 3.3.22: update J2Store / J2Commerce to 3.3.22 for this flaw, or to 4.1.8 or later, which no rule we check matches. For J2Store / J2Commerce from 4.0.21 up to but not including 4.0.22: update J2Store / J2Commerce to 4.0.22 for this flaw, or to 4.1.8 or later, which no rule we check matches. For J2Store / J2Commerce from 4.1.6 up to but not including 4.1.7: update J2Store / J2Commerce to 4.1.7 for this flaw, or to 4.1.8 or later, which no rule we check matches.

How severe is CVE-2026-78064?

Joomla CNA scores it 8.8 (High) under CVSS 4.0. In plain terms: reachable across the internet, no account needed and nobody has to be tricked into anything.

## Running an affected version on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, [fix.mysites.guru](https://fix.mysites.guru/) is a single fixed fee per incident, usually resolved the same day.

This check is part of the [mySites.guru Joomla vulnerability scanner](https://mysites.guru/joomla-vulnerability-scanner/), which reads every installed extension's version on each audit. Browse the rest of the [Joomla vulnerability database](https://mysites.guru/vulnerabilities/).

Rules current as of 14 October 2026.