CVE-2026-67359
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Joomla extension J2Store (versions 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5) allows an unauthenticated visitor to supply any order_id as a query parameter to render the full checkout confirmation page for that order, including line items, prices, and totals.
Risk Assessment
Disclosure of order details can violate customer privacy and expose sensitive business information, potentially leading to data theft or unauthorized access.
Recommendation
It is recommended to update J2Store to a version that fixes this vulnerability and to restrict access to order pages to authenticated users only.
Other vulnerabilities in J2Store
See all- CVE-2026-74252High
Joomla extension J2Store (versions 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5) is vulnerable to Stored Cross-Site Scripting (XSS) through the guest checkout billing address fields. An unauthenticated attacker exploits a filter bypass in Joomla's Input::getArray() combined with PHP's variables_order=EGPCS (Cookie overrides POST in $_REQUEST) to store unsanitized HTML in fields such as billing_first_name.
- CVE-2026-67362Medium
Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the shop's trusted domain. No authentication required.
- CVE-2026-67361Medium
Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted the upload and invoices directories, causing fresh installs to deploy those directories without .htaccess/web.config protection, making uploaded files directly web-accessible.
- CVE-2026-67360Medium
Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user could supply another customer's order_id to copy their cart contents and address data into the attacker's session. The CSRF token was validated but ownership was not checked.
- CVE-2026-67358Medium
Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user with a valid order token could increment the download limit counter on a download record belonging to a different order. The endpoint also lacked a CSRF token.
Original NVD description (English source)
Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any order_id as a query parameter to render the full checkout confirmation page for that order, including line items, prices, and totals.