The vulnerability allows any visitor to retrieve complete financial and item details for any order by including an arbitrary order_id in the URL. This results in the disclosure of sensitive customer information such as product names, quantities, prices, and totals. The weakness falls under CWE-639 and directly compromises confidentiality of transactional data without requiring authentication.

The flaw is present in the J2Store extension for Joomla released by j2commerce.com. Affected versions range from 1.0.0 through 3.3.20, 4.0.0 through 4.0.20, and 4.1.0 through 4.1.5. All installations of the extension within these version ranges that expose the confirmation page to the public are vulnerable.

The CVSS score of 8.7 classifies the issue as high severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw simply by sending an unauthenticated HTTP request containing an order_id parameter, meaning the attack vector is external and does not require privileged access. Given the lack of mitigation in affected versions, the likelihood of exploitation is significant in environments where the site is publicly accessible.