The vulnerability allows an attacker who knows the Joomla secret to compute a valid order access token. This token grants guest access to any order, exposing order details and digital downloads. The token is never rotated, so the exposure persists unless the Joomla secret itself is changed. The weakness is identified as CWE-1241, reflecting a predictable token.

The affected product is j2commerce.com, including versions 1.0.0 through 3.3.2, 4.0.0 through 4.0.22, and 4.1.0 through 4.1.7. Any site running these releases is impacted.

The CVSS score of 6.3 indicates medium severity. Exploitation requires the attacker to obtain the Joomla secret, a condition that may stem from another compromise. Once the secret is known, the attacker can repeatedly generate order tokens and obtain order contents indefinitely because the token is static. The EPSS score is 0.00207 (<1%), and the vulnerability is not listed in CISA KEV, indicating no known public exploitation.