J2Store / J2Commerce (com_j2store) 3.3.21 (Joomla 3 branch) - Unauthenticated Payment Callback Forgery and Cart Tampering, Backend Privilege Escalation, Guest Address IDOR and Reflected XSS (5 CVEs)
J2Store 3.3.21 on the Joomla 3 branch is affected by five vulnerabilities in com_j2store, disclosed by Phil Taylor (mySites.guru) and fixed by J2Commerce on 31 August 2026. CVE-2026-78069 (CVSS 9.5, Critical): the administrator Apps controller instantiates app-plugin controllers through an appTask delegation path with no com_j2store ACL check anywhere in the code, and the backend node of fof.xml declares no view ACL at all, so FOF defaults an unmatched task to allow rather than deny. Any authenticated Joomla backend user, holding no J2Store permission whatsoever, can trigger #__j2store_* table truncation and traversal-based SQL file execution; only the Joomla core administrator login wall keeps anonymous visitors out, and that checks nothing about com_j2store permissions. CVE-2026-78064 (CVSS 8.8, High): the carts view inherits the generic FOF save task under a wildcard true ACL in fof.xml, and FOF enforces CSRF tokens only on backend HTML requests, not on frontend format=raw requests, so an unauthenticated POST can insert cart rows with an attacker-chosen user_id or session_id, or overwrite an existing row by id. CVE-2026-77999 (CVSS 8.7, High): the PayPal IPN listener treated UNVERIFIED and any non-INVALID response as valid, made its verification request with CURLOPT_SSL_VERIFYPEER disabled, and stored the verdict in a field nothing downstream read, so processing continued regardless of the outcome; separately, omitting mc_gross from the POST body skipped the paid-amount comparison entirely. Unauthenticated requests could confirm orders that were never paid for, or fail legitimate ones. CVE-2026-78065 (CVSS 7.1, High): editAddress() redirected non-owners away only when the loaded address row had a non-empty user_id, and guest checkout rows have none, so any logged-in account guessing a small sequential address_id was shown a guest customer full name, street address and phone number prefilled into the edit form. CVE-2026-78000 (CVSS 5.3, Medium): filter_tag, pricefrom and priceto are echoed unescaped into a hidden input value attribute by J2Html::input(), across all six shipped product-tags templates, giving reflected XSS from a crafted link with no click beyond the initial navigation. FIX: update to 3.3.22 on this Joomla 3 branch (the equivalent fixes are 4.0.22 on 4.0.x and 4.1.7 on 4.1.x). If you cannot update immediately: disable PayPal, or watch pending orders for CONFIRMED or FAILED transitions with no matching PayPal transaction; disable guest checkout; and review every Joomla backend account regardless of privilege level, because the Apps controller issue needs a backend login but no J2Store permission. All five CVE records were published by the Joomla CNA on 3 September 2026 and all five credit Phil Taylor, mySites.guru. The affected ranges are unchanged. Four scores match the vendor advisory; CVE-2026-78069 was raised from the vendor's 9.4 to 9.5 Critical, and the published vector reads AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, scoring the backend login as an attack requirement (AT:P) rather than a privilege (PR:L).
Affected versions: ≥ 3.3.21 and < 3.3.22
Full advisory: our disclosure post · www.j2commerce.com
J2Store / J2Commerce (com_j2store) 4.0.21 (Joomla 4.0 branch) - Unauthenticated Payment Callback Forgery and Cart Tampering, Backend Privilege Escalation, Guest Address IDOR and Reflected XSS (5 CVEs)
J2Store / J2Commerce 4.0.21 is affected by five vulnerabilities in com_j2store, disclosed by Phil Taylor (mySites.guru) and fixed by J2Commerce on 31 August 2026. CVE-2026-78069 (CVSS 9.5, Critical): the administrator Apps controller instantiates app-plugin controllers through an appTask delegation path with no com_j2store ACL check anywhere in the code, and the backend node of fof.xml declares no view ACL at all, so FOF defaults an unmatched task to allow rather than deny. Any authenticated Joomla backend user, holding no J2Store permission whatsoever, can trigger #__j2store_* table truncation and traversal-based SQL file execution; only the Joomla core administrator login wall keeps anonymous visitors out, and that checks nothing about com_j2store permissions. CVE-2026-78064 (CVSS 8.8, High): the carts view inherits the generic FOF save task under a wildcard true ACL in fof.xml, and FOF enforces CSRF tokens only on backend HTML requests, not on frontend format=raw requests, so an unauthenticated POST can insert cart rows with an attacker-chosen user_id or session_id, or overwrite an existing row by id. CVE-2026-77999 (CVSS 8.7, High): the PayPal IPN listener treated UNVERIFIED and any non-INVALID response as valid, made its verification request with CURLOPT_SSL_VERIFYPEER disabled, and stored the verdict in a field nothing downstream read, so processing continued regardless of the outcome; separately, omitting mc_gross from the POST body skipped the paid-amount comparison entirely. Unauthenticated requests could confirm orders that were never paid for, or fail legitimate ones. CVE-2026-78065 (CVSS 7.1, High): editAddress() redirected non-owners away only when the loaded address row had a non-empty user_id, and guest checkout rows have none, so any logged-in account guessing a small sequential address_id was shown a guest customer full name, street address and phone number prefilled into the edit form. CVE-2026-78000 (CVSS 5.3, Medium): filter_tag, pricefrom and priceto are echoed unescaped into a hidden input value attribute by J2Html::input(), across all six shipped product-tags templates, giving reflected XSS from a crafted link with no click beyond the initial navigation. FIX: update to 4.0.22 on this 4.0.x branch (the equivalent fixes are 3.3.22 on the Joomla 3 branch and 4.1.7 on 4.1.x). If you cannot update immediately: disable PayPal, or watch pending orders for CONFIRMED or FAILED transitions with no matching PayPal transaction; disable guest checkout; and review every Joomla backend account regardless of privilege level, because the Apps controller issue needs a backend login but no J2Store permission. All five CVE records were published by the Joomla CNA on 3 September 2026 and all five credit Phil Taylor, mySites.guru. The affected ranges are unchanged. Four scores match the vendor advisory; CVE-2026-78069 was raised from the vendor's 9.4 to 9.5 Critical, and the published vector reads AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, scoring the backend login as an attack requirement (AT:P) rather than a privilege (PR:L).
Affected versions: ≥ 4.0.21 and < 4.0.22
Full advisory: our disclosure post · www.j2commerce.com
J2Store / J2Commerce (com_j2store) 4.1.6 (Joomla 4.1 branch) - Unauthenticated Payment Callback Forgery and Cart Tampering, Backend Privilege Escalation, Guest Address IDOR and Reflected XSS (5 CVEs)
J2Store / J2Commerce 4.1.6 is affected by five vulnerabilities in com_j2store, disclosed by Phil Taylor (mySites.guru) and fixed by J2Commerce on 31 August 2026. CVE-2026-78069 (CVSS 9.5, Critical): the administrator Apps controller instantiates app-plugin controllers through an appTask delegation path with no com_j2store ACL check anywhere in the code, and the backend node of fof.xml declares no view ACL at all, so FOF defaults an unmatched task to allow rather than deny. Any authenticated Joomla backend user, holding no J2Store permission whatsoever, can trigger #__j2store_* table truncation and traversal-based SQL file execution; only the Joomla core administrator login wall keeps anonymous visitors out, and that checks nothing about com_j2store permissions. CVE-2026-78064 (CVSS 8.8, High): the carts view inherits the generic FOF save task under a wildcard true ACL in fof.xml, and FOF enforces CSRF tokens only on backend HTML requests, not on frontend format=raw requests, so an unauthenticated POST can insert cart rows with an attacker-chosen user_id or session_id, or overwrite an existing row by id. CVE-2026-77999 (CVSS 8.7, High): the PayPal IPN listener treated UNVERIFIED and any non-INVALID response as valid, made its verification request with CURLOPT_SSL_VERIFYPEER disabled, and stored the verdict in a field nothing downstream read, so processing continued regardless of the outcome; separately, omitting mc_gross from the POST body skipped the paid-amount comparison entirely. Unauthenticated requests could confirm orders that were never paid for, or fail legitimate ones. CVE-2026-78065 (CVSS 7.1, High): editAddress() redirected non-owners away only when the loaded address row had a non-empty user_id, and guest checkout rows have none, so any logged-in account guessing a small sequential address_id was shown a guest customer full name, street address and phone number prefilled into the edit form. CVE-2026-78000 (CVSS 5.3, Medium): filter_tag, pricefrom and priceto are echoed unescaped into a hidden input value attribute by J2Html::input(), across all six shipped product-tags templates, giving reflected XSS from a crafted link with no click beyond the initial navigation. FIX: update to 4.1.7 on this 4.1.x branch (the equivalent fixes are 3.3.22 on the Joomla 3 branch and 4.0.22 on 4.0.x). If you cannot update immediately: disable PayPal, or watch pending orders for CONFIRMED or FAILED transitions with no matching PayPal transaction; disable guest checkout; and review every Joomla backend account regardless of privilege level, because the Apps controller issue needs a backend login but no J2Store permission. All five CVE records were published by the Joomla CNA on 3 September 2026 and all five credit Phil Taylor, mySites.guru. The affected ranges are unchanged. Four scores match the vendor advisory; CVE-2026-78069 was raised from the vendor's 9.4 to 9.5 Critical, and the published vector reads AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, scoring the backend login as an attack requirement (AT:P) rather than a privilege (PR:L).
Affected versions: ≥ 4.1.6 and < 4.1.7
Full advisory: our disclosure post · www.j2commerce.com
J2Store / J2Commerce (com_j2store) below 3.3.21 (Joomla 3 branch) - Unauthenticated File Upload (exploited in the wild), Order Data Disclosure, Stored XSS and IDOR (6 CVEs)
J2Store on the Joomla 3 branch before 3.3.21 is affected by six vulnerabilities in com_j2store, disclosed and fixed by J2Commerce on 20 August 2026. CVE-2026-67361 (CVSS 6.9): the cart file-upload endpoint (view=carts, task=upload) accepted POST requests from unauthenticated visitors with no CSRF token, and the installer manifest omitted media/j2store/uploads/ and media/j2store/invoices/ from its media section, so fresh installs created those folders without their .htaccess and web.config protection and uploaded files were directly reachable by URL. The vendor confirms this was EXPLOITED IN THE WILD before the fix shipped. Joomla's MediaHelper::canUpload() blocked .php, so remote code execution was not achieved, but arbitrary images, PDFs, CSVs and documents could be written and then retrieved publicly. CVE-2026-67359 (CVSS 8.7): an unauthenticated visitor could pass any order_id to view=checkout, task=expressconfirm and render another customer's full express-checkout confirmation page, including line items, quantities, prices and totals. CVE-2026-74252 (CVSS 8.6): unauthenticated stored XSS through the guest checkout billing address fields, via a filter bypass in Joomla's Input::getArray() combined with PHP variables_order=EGPCS letting a cookie override POST in $_REQUEST; the payload fires in the administrator order management panel. CVE-2026-67360 (CVSS 6.3): an authenticated user who obtained another customer's order_id could call view=myprofile, task=reOrder and copy that customer's cart contents, product options and billing/shipping address IDs into their own session; the CSRF token was checked but ownership was not. CVE-2026-67358 (CVSS 5.3): a user holding a valid order token could increment the download limit counter on a download record belonging to a different order, and the endpoint had no CSRF token. CVE-2026-67362 (CVSS 5.1): four cart task handlers (setcurrency, addItem, applyCoupon, applyVoucher) decoded a base64 URL supplied by the user and redirected to it with no host validation, enabling phishing from the shop's own trusted domain, unauthenticated. FIX: update to 3.3.21 on this Joomla 3 branch (the equivalent fixes are 4.0.21 on 4.0.x and 4.1.6 on 4.1.x). J2Commerce 6 is a separate rewritten codebase and is not affected. Because the upload flaw was exploited in the wild, also review media/j2store/uploads/ and the older media/com_j2store/uploads/ for files you do not recognise: the 3.3.21 installer scans and lists them but deliberately deletes nothing. Versions below 3.3.13 are additionally affected by CVE-2020-13996, an authenticated Store Manager SQL injection; updating to 3.3.21 resolves that as well. UPDATE, 31 August 2026: a further five vulnerabilities (CVE-2026-77999, CVE-2026-78000, CVE-2026-78064, CVE-2026-78065 and CVE-2026-78069, up to CVSS 9.4 Critical) affect every build below 3.3.22, so 3.3.21 is no longer a sufficient fix. Update to 3.3.22.
Affected versions: < 3.3.21
Full advisory: www.j2commerce.com · our disclosure post
J2Store / J2Commerce (com_j2store) 4.0.0 to 4.0.20 - Unauthenticated File Upload (exploited in the wild), Order Data Disclosure, Stored XSS and IDOR (6 CVEs)
J2Store / J2Commerce 4.0.x before 4.0.21 is affected by six vulnerabilities in com_j2store, disclosed and fixed by J2Commerce on 20 August 2026. CVE-2026-67361 (CVSS 6.9): the cart file-upload endpoint (view=carts, task=upload) accepted POST requests from unauthenticated visitors with no CSRF token, and the installer manifest omitted media/j2store/uploads/ and media/j2store/invoices/ from its media section, so fresh installs created those folders without their .htaccess and web.config protection and uploaded files were directly reachable by URL. The vendor confirms this was EXPLOITED IN THE WILD before the fix shipped. Joomla's MediaHelper::canUpload() blocked .php, so remote code execution was not achieved, but arbitrary images, PDFs, CSVs and documents could be written and then retrieved publicly. CVE-2026-67359 (CVSS 8.7): an unauthenticated visitor could pass any order_id to view=checkout, task=expressconfirm and render another customer's full express-checkout confirmation page, including line items, quantities, prices and totals. CVE-2026-74252 (CVSS 8.6): unauthenticated stored XSS through the guest checkout billing address fields, via a filter bypass in Joomla's Input::getArray() combined with PHP variables_order=EGPCS letting a cookie override POST in $_REQUEST; the payload fires in the administrator order management panel. CVE-2026-67360 (CVSS 6.3): an authenticated user who obtained another customer's order_id could call view=myprofile, task=reOrder and copy that customer's cart contents, product options and billing/shipping address IDs into their own session; the CSRF token was checked but ownership was not. CVE-2026-67358 (CVSS 5.3): a user holding a valid order token could increment the download limit counter on a download record belonging to a different order, and the endpoint had no CSRF token. CVE-2026-67362 (CVSS 5.1): four cart task handlers (setcurrency, addItem, applyCoupon, applyVoucher) decoded a base64 URL supplied by the user and redirected to it with no host validation, enabling phishing from the shop's own trusted domain, unauthenticated. FIX: update to 4.0.21 on this 4.0.x branch (the equivalent fixes are 3.3.21 on the Joomla 3 branch and 4.1.6 on 4.1.x). J2Commerce 6 is a separate rewritten codebase and is not affected. Because the upload flaw was exploited in the wild, also review media/j2store/uploads/ and the older media/com_j2store/uploads/ for files you do not recognise: the 4.0.21 installer scans and lists them but deliberately deletes nothing. UPDATE, 31 August 2026: a further five vulnerabilities (CVE-2026-77999, CVE-2026-78000, CVE-2026-78064, CVE-2026-78065 and CVE-2026-78069, up to CVSS 9.4 Critical) affect every build below 4.0.22, so 4.0.21 is no longer a sufficient fix. Update to 4.0.22.
Affected versions: ≥ 4.0.0 and < 4.0.21
Full advisory: www.j2commerce.com · our disclosure post
J2Store / J2Commerce (com_j2store) 4.1.0 to 4.1.5 - Unauthenticated File Upload (exploited in the wild), Order Data Disclosure, Stored XSS and IDOR (6 CVEs)
J2Store / J2Commerce 4.1.x before 4.1.6 is affected by six vulnerabilities in com_j2store, disclosed and fixed by J2Commerce on 20 August 2026. CVE-2026-67361 (CVSS 6.9): the cart file-upload endpoint (view=carts, task=upload) accepted POST requests from unauthenticated visitors with no CSRF token, and the installer manifest omitted media/j2store/uploads/ and media/j2store/invoices/ from its media section, so fresh installs created those folders without their .htaccess and web.config protection and uploaded files were directly reachable by URL. The vendor confirms this was EXPLOITED IN THE WILD before the fix shipped. Joomla's MediaHelper::canUpload() blocked .php, so remote code execution was not achieved, but arbitrary images, PDFs, CSVs and documents could be written and then retrieved publicly. CVE-2026-67359 (CVSS 8.7): an unauthenticated visitor could pass any order_id to view=checkout, task=expressconfirm and render another customer's full express-checkout confirmation page, including line items, quantities, prices and totals. CVE-2026-74252 (CVSS 8.6): unauthenticated stored XSS through the guest checkout billing address fields, via a filter bypass in Joomla's Input::getArray() combined with PHP variables_order=EGPCS letting a cookie override POST in $_REQUEST; the payload fires in the administrator order management panel. CVE-2026-67360 (CVSS 6.3): an authenticated user who obtained another customer's order_id could call view=myprofile, task=reOrder and copy that customer's cart contents, product options and billing/shipping address IDs into their own session; the CSRF token was checked but ownership was not. CVE-2026-67358 (CVSS 5.3): a user holding a valid order token could increment the download limit counter on a download record belonging to a different order, and the endpoint had no CSRF token. CVE-2026-67362 (CVSS 5.1): four cart task handlers (setcurrency, addItem, applyCoupon, applyVoucher) decoded a base64 URL supplied by the user and redirected to it with no host validation, enabling phishing from the shop's own trusted domain, unauthenticated. FIX: update to 4.1.6 on this 4.1.x branch (the equivalent fixes are 3.3.21 on the Joomla 3 branch and 4.0.21 on 4.0.x). J2Commerce 6 is a separate rewritten codebase and is not affected. Because the upload flaw was exploited in the wild, also review media/j2store/uploads/ and the older media/com_j2store/uploads/ for files you do not recognise: the 4.1.6 installer scans and lists them but deliberately deletes nothing. UPDATE, 31 August 2026: a further five vulnerabilities (CVE-2026-77999, CVE-2026-78000, CVE-2026-78064, CVE-2026-78065 and CVE-2026-78069, up to CVSS 9.4 Critical) affect every build below 4.1.7, so 4.1.6 is no longer a sufficient fix. Update to 4.1.7.
Affected versions: ≥ 4.1.0 and < 4.1.6
Full advisory: www.j2commerce.com · our disclosure post
