CVE-2026-67360

Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Published Aug 21, 2026 CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Description

Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user could supply another customer's order_id to copy their cart contents and address data into the attacker's session. The CSRF token was validated but ownership was not checked.

Analysis

Technical impact

The vulnerability allows an authenticated user to supply another customer’s order_id to copy their cart contents and address data into the attacker’s session. Although a CSRF token is validated, the ownership of the order is not checked, resulting in unauthorized data exposure.

Affected Systems

Affected systems are the J2Store extension for Joomla distributed by j2commerce.com. Versions 1.0.0 through 3.3.20, 4.0.0 through 4.0.20, and 4.1.0 through 4.1.5 are impacted.

Risk and Exploitability

The CVSS score of 6.3 indicates a moderate severity, and the lack of an EPSS score or KEV listing suggests the vulnerability has not yet been widely exploited. Attackers must be authenticated, but once logged in they can extract another user’s personal order details without authorization, posing privacy and potential data leakage risks. Proper ownership checks or disabling the replication feature can mitigate the risk.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

j2commerce.com

J2Store extension for Joomla

unaffected

Version	Status	Constraints
`1.0.0-3.3.20`	affected	—
`4.0.0-4.0.20`	affected	—
`4.1.0-4.1.5`	affected	—

No data.

Vendor Product Versions

J2commerce.com

J2store Extension For Joomla

Version	Status	Scheme	Platform
`[1.0.0,3.3.20]`	affected	semver	—
`[4.0.0,4.0.20]`	affected	semver	—
`[4.1.0,4.1.5]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade J2Store to a version that resolves the ownership check flaw; if no patch is available, contact the vendor for an update.
Implement server‑side validation to verify that the order_id belongs to the current authenticated user before allowing cart replication.
Disable or remove the cart replication functionality if it is not required for normal business processes.
Monitor logs for anomalous cart replication activity to detect potential exploitation.

Generated by OpenCVE AI on August 21, 2026 at 20:46 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.406% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.j2commerce.com/

History

Aug 23, 2026 5:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		J2commerce.com J2commerce.com j2store Extension For Joomla
Vendors & Products		J2commerce.com J2commerce.com j2store Extension For Joomla

Aug 21, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 21, 2026 7:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user could supply another customer's order_id to copy their cart contents and address data into the attacker's session. The CSRF token was validated but ownership was not checked.
Title		Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
Weaknesses		CWE-639
References		https://www.j2commerce.com/
Metrics		cvssV4_0 `{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}`