Missing CSRF tokens on many AJAX and state‑changing tasks in the J‑BusinessDirectory extension allow an attacker to perform a wide range of unauthorized actions such as submitting contact or quote forms, adding items to carts, creating bookmarks, uploading files, sending messages, generating AI text, and, on the administrative side, installing applications, wiping demo data, archiving cache and statistics, sending payment notifications, and pushing mobile alerts. The weakness is a classic Cross‑Site Request Forgery (CWE‑352), permitting the attacker to impersonate the victim, whether a registered listing owner or a backend administrator.

The vulnerability affects the cmsjunkie.com J‑BusinessDirectory extension for Joomla. Versions earlier than 6.2.3 are impacted. The extension relies on Joomla’s session mechanisms, so the CSRF exploitation requires a valid frontend session for owner‑level actions or an active backend admin session for administrator tasks.

The CVSS score of 4.6 indicates moderate risk. The EPSS score is <1%, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is a web browser; an attacker can craft a malicious link or embed a request in a third‑party page that a logged‑in user will load, triggering the state‑changing action because no token protects the request. As the vulnerability requires only an authenticated session on the victim’s side and offers no further prerequisites, exploitation probability is low for targets that have not addressed the missing tokens.