The vulnerability arises from a missing authorization check in the J2Store Apps controller delegation chain. The controller instantiates app‑plugin controllers without enforcing ACL, allowing any caller to trigger the appTask method. Through this path an attacker can provide malicious input that is used to build a table name and to create a file path for executing SQL files. The result is the ability to truncate arbitrary #__j2store_* tables and run arbitrary SQL scripts, which can destroy data or modify the database in a way that effectively allows remote code execution on the server. The flaw is a classic example of CWE‑862, where insufficient authorization leads to privilege escalation and uncontrolled data manipulation.

The flaw affects the J2Store extension for Joomla maintained by j2commerce.com. Versions 1.0.0 through 3.3.21, 4.0.0 through 4.0.21, and 4.1.0 through 4.1.6 are known to be vulnerable. Users running these editions on a Joomla site are at risk, as the vulnerable code resides in the extension’s controller logic.

With a CVSS score of 9.5 the vulnerability is classified as critical. No EPSS score is available, but the absence of a requirement for authentication in the description indicates that a remote attacker can exploit it solely through HTTP requests to the vulnerable controller. The vulnerability is not yet listed in CISA’s KEV catalog, yet its potential for data loss and remote code execution warrants immediate attention.