The vulnerability allows an authenticated user who possesses a valid order token to increase the download quota counter for a download record associated with a different order. Because the endpoint does not enforce a CSRF token, the attacker can easily submit the request and alter the quota without the target’s awareness. This misuse of the quota system permits unauthorized access to additional downloads, potentially leading to resource abuse or denial of service for legitimate users.

This issue affects the J2Store extension for Joomla produced by j2commerce.com. Vulnerable versions include all releases from 1.0.0 to 3.3.20, from 4.0.0 to 4.0.20, and from 4.1.0 to 4.1.5.

The vulnerability is rated a 5.3 on CVSS, which is moderate. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be an authenticated user with a valid order token. The absence of a CSRF token reduces the difficulty of constructing a request; however, the attacker still needs to know or obtain a token that belongs to a different order. Given these constraints, the likelihood of exploitation is moderate, and the impact is primarily resource abuse rather than code execution.