Skip to main content
mySites.guru
Free Audit
NewAdd every Joomla and WordPress site on a WHM or cPanel server in one goSee how it works

J2Commerce security vulnerabilities

mySites.guru tracks 1 vulnerability in J2Commerce (com_j2commerce), covering 1 CVE. Every connected Joomla site is checked against it on each audit.

Is my site affected?

Your site is affected if it runs J2Commerce in this range:

  • from 6.0.0 up to but not including 6.6.6
Latest safe version
6.6.6 or later. No rule we check matches that release or any newer one.
What to do
Update J2Commerce to 6.6.6 or later from the vendor, then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
Check whether your sites are affected

Every J2Commerce vulnerability we track

Newest first. CVSS is the score published in each CVE record, where it has one; the severity column is the rating our check uses.

CVEAffected versionsFixed inSeverityAdded
CVE-2026-102803CVSS 6.0from 6.0.0 up to but not including 6.6.66.6.6Medium2026-11-09

What we check for

MediumCVE-2026-1028032026-11-09

J2Commerce (com_j2commerce) 6.0.0 to 6.6.5 - CVE-2026-102803 Gift Voucher and Single-Use Coupon Reuse (checkout race condition)

J2Commerce 6.0.0 to 6.6.5 (listed in the CVE record as J2Store 6.0.0 - 6.6.5) let a logged-in customer redeem one gift voucher, or one single-use coupon, on more than one order. By opening several checkout sessions and taking each to the confirm step before submitting any of them, every order saw the voucher's full balance or the coupon's unused slot, because the balance and usage checks only counted orders that had already left the New state. CVSS 4.0 score 6.0 (Medium). Fixed in J2Commerce 6.6.6: update to 6.6.6 or later. This is the J2Commerce 6 component (com_j2commerce), not the older J2Store 3.x/4.x line (com_j2store).

Affected versions: ≥ 6.0.0 and < 6.6.6

Full advisory: our disclosure post

Timeline

  1. 9 November 2026Check added for CVE-2026-102803 (from 6.0.0 up to but not including 6.6.6)
  2. 10 November 2026CVE-2026-102803 record published
  3. 10 November 2026We published: J2Commerce 6.6.6 Stops One Gift Voucher Paying for Several Orders

What we have written about J2Commerce

J2Commerce 6.6.6 Stops One Gift Voucher Paying for Several Orders

J2Commerce 6.6.6 Stops One Gift Voucher Paying for Several Orders

J2Commerce 6.6.6 fixes CVE-2026-102803, a checkout race that let one gift voucher or single-use coupon pay for several orders. Who is affected, what to do.

References

Each CVE page above links its official cve.org record and its NVD entry.

J2Commerce vulnerability questions

Which versions of J2Commerce are vulnerable?
mySites.guru tracks one vulnerability in J2Commerce (com_j2commerce). A site is affected if its installed version is in this range: from 6.0.0 up to but not including 6.6.6.
What is the latest safe version of J2Commerce?
6.6.6. Every vulnerability tracked here is fixed by 6.6.6, and no rule we check matches that release or any later one.
How do I check which version of J2Commerce my Joomla site runs?
The installed version is listed on the Joomla administrator's Extensions: Manage screen; search it for com_j2commerce. mySites.guru reads the installed version on every audit of a connected site and checks it against this rule.

Running J2Commerce on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.

CVE identifiers: CVE-2026-102803. Rules current as of 10 November 2026.