Guest checkout addresses in J2Store are stored without an associated user identifier. The editAddress() routine performs an ownership check only when an address row contains a non‑empty user_id. Because guest‑checkout rows have an empty user_id, the check fails to trigger, allowing any authenticated user to guess a sequential address_id and view another guest customer’s full name, street address, and phone number in an edit form. This flaw provides direct access to personally identifiable information, exposing users to privacy violations and potential fraud.

The vulnerability affects Joomla sites running the j2commerce.com J2Store extension for Joomla. Versions 1.0.0 through 3.3.21, 4.0.0 through 4.0.21, and 4.1.0 through 4.1.6 are impacted.

The flaw yields a moderate‑to‑high severity (CVSS 7.1). EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not widely exploited yet. Attackers need only be authenticated and can discover affected addresses by iterating sequential address identifiers. Because the exploit targets only authenticated users and does not require additional system privileges, the risk is primarily confined to the confidentiality of guest customer data rather than full system compromise.