The vulnerability lies in the PayPal IPN listener of the J2Store extension, which accepts responses marked as UNVERIFIED or any status other than INVALID, disables SSL peer verification on the validation request, and stores the verification result in a field that is never checked downstream. Additionally, the amount validation routine is bypassed when the posted gross amount is missing or not a positive value, allowing the check to be skipped entirely. These flaws allow an unauthenticated attacker to forge a PayPal callback, supply a receiver_email that matches the merchant configuration, and embed a sequential order ID in the custom field. When combined, the attacker can promote a pending order directly to CONFIRMED without payment or invalidate another customer's pending order, creating a path for fraudulent transaction confirmation or denial. The impact is real financial loss through unauthorized order acceptance or forced cancellations.

The affected applications are the Joomla CMS with the J2Store extension published by j2commerce.com. Versions 1.0.0 through 3.3.21, 4.0.0 through 4.0.21, and 4.1.0 through 4.1.6 are vulnerable. No additional products or versions are listed.

The CVSS score of 8.7 indicates a high severity rating, reflecting the possibility of a remote attacker to impersonate PayPal and manipulate order states without authentication. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog, but the attack vector is straightforward: an unauthenticated HTTP POST to the IPN listener with crafted parameters. Once the verification step is weakened and amount checks bypassed, the probability of exploitation rises considerably, especially for sites that use default settings for PayPal receiver email and do not enforce strict input validation.