The vulnerability is an open redirect in the cart controller of the J2Store Joomla extension. Four task handlers accept a Base64‑encoded URL supplied by a user and redirect without validating the hostname. This lack of host verification permits attackers to redirect customers to malicious sites while using the shop’s trusted domain, facilitating phishing attacks. No authentication is required, so any web visitor can trigger the redirect.

The affected product is the j2commerce.com J2Store extension for Joomla. Version ranges 1.0.0 through 3.3.20, 4.0.0 through 4.0.20, and 4.1.0 through 4.1.5 contain the flaw. All Joomla sites running these versions of the extension are vulnerable.

The CVSS score of 5.1 indicates moderate risk, and the EPSS score is not available. The flaw is not listed in the CISA KEV catalog. Exploitability is straightforward: an attacker can craft a malicious Base64‑encoded URL, place it in the cart controller via the task parameter, and lure users to a phishing domain. Because the redirect bypasses host validation and requires no authentication, the threat affects every site visitor and can be used for credential theft or malware delivery if users are lured to a malicious domain.