The vulnerability arises from the inherited FOF `save` task within J2Store, which has a wildcard ACL set to true for the `carts` view. Because FOF only enforces CSRF tokens on back‑end HTML requests, front‑end requests using `format=raw` bypass CSRF protection. Attackers can exploit this to create new cart entries or overwrite existing ones by supplying arbitrary `user_id` or `session_id` values. The primary impact is the ability to modify cart data in an unauthorized manner, potentially enabling malicious shop manipulation, financial fraud, and loss of customer trust. This represents a data integrity compromise that affects the confidentiality and correctness of the e‑commerce platform.

Affected Systems: The flaw exists in the J2Store extension for Joomla, released by j2commerce.com, affecting versions 1.0.0 through 3.3.21, 4.0.0 through 4.0.21, and 4.1.0 through 4.1.6. Administrators using any of these releases should be aware that cart operations can be hijacked without authentication.

Risk and Exploitability: With a CVSS score of 8.8, the vulnerability is considered high severity. Although no EPSS score is available, the absence of CSRF enforcement on the front end and the wildcard ACL give attackers a straightforward exploitation path with little prerequisite knowledge. The vulnerability is not yet listed in the CISA KEV catalog, but its potential for financial impact warrants immediate attention. The likely attack vector is through a front‑end HTTP request to the cart controller, leveraging the raw format to inject or override cart data.