Security Announcement - Releases 3.3.22, 4.0.22 and 4.1.7

Release date: 2026-08-31
Affected versions: All J2Store versions prior to 4.1.7
Fixed in: J2Store 3.3.22, 4.0.22 and 4.1.7
Severity: High (CVSS 4.0 scores range from 5.3 to 9.4)

Overview

J2Store 3.3.22, 4.0.22 and 4.1.7 are security releases that address five vulnerabilities in the com_j2store component: one unauthenticated payment-callback forgery issue that let anonymous requests confirm or fail arbitrary orders, one reflected XSS issue in the product-tags filter UI, one authorization issue where an inherited framework task accepted anonymous writes to other customers' cart records, one IDOR issue disclosing guest checkout addresses to any logged-in user, and one missing-authorization issue on an administrator delegation path that lets any authenticated backend user — regardless of their com_j2store permissions — trigger table truncation and path traversal.

All five issues affect every currently supported release line: Joomla 3 (J2Store 3.3.x), Joomla 4.0 (J2Store 4.0.x), and Joomla 4.1 (J2Store 4.1.x), since the vulnerable code is shared across branches.

Users running J2Store 3.3.21 or earlier, 4.0.21 or earlier, or 4.1.6 or earlier are advised to update immediately: to 3.3.22 if you are still on Joomla 3, to 4.0.22 if you run 4.0.x, or to 4.1.7 if you run 4.1.x.

Vulnerabilities Fixed

1. Unauthenticated PayPal callback forgery leading to order confirmation fraud

CVE: 2026-77999
Task: POST com_j2store / view=callback / method=payment_paypal / paction=process
CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N / Base Score: 8.7 / Severity: High
Files: plugins/j2store/payment_paypal/{paypalv2,paypalv3,paypalv32}.php

The PayPal IPN listener's signature check (_validateIPN()) accepted UNVERIFIED and any non-INVALID response as valid, made its verification request with CURLOPT_SSL_VERIFYPEER disabled, and stored its verdict in a field nothing downstream ever checked — so processing continued regardless of the outcome. Separately, the paid-amount comparison only ran when mc_gross was a positive number; omitting the field from the POST body (floatval(null) == 0) skipped the check entirely. 

Impact: Unauthenticated financial fraud (free order confirmation) and denial of legitimate orders, verified against a live test installation.

2. Reflected XSS via filter_tag, pricefrom and priceto

CVE: 2026-78000
Task: GET com_j2store / view=producttags / task=browse
CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N / Base Score: 5.3 / Severity: Medium
CWE: CWE-79 — Improper Neutralization of Input During Web Page Generation
Files: administrator/components/com_j2store/helpers/j2html.php, all six tag_* front-end templates

The product-tags listing echoed filter_tag unescaped into a hidden <input>'s value attribute, via J2Html::input()'s hidden branch, in every shipped template family (tag_default, tag_bootstrap3, tag_bootstrap4, each with default.php, default_filters.php, and default_sortfilter.php). pricefrom and priceto behave the same wherever the price-filter UI is enabled. A value containing " closes the attribute early and injects an event handler.

Impact: Arbitrary JavaScript execution in a victim's browser after opening a crafted link, e.g. filter_tag=" autofocus onfocus=alert(1) x=" — no click beyond the initial navigation is required.

3. Anonymous cart-record tampering via inherited FOF save task

CVE: 2026-78064
Task: POST com_j2store / view=carts / task=save / format=raw
CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N / Base Score: 8.8 / Severity: High
File: components/com_j2store/controllers/carts.php

fof.xml grants the carts view's tasks a wildcard true ACL, and FOF only enforces CSRF tokens on back-end HTML requests, not on front-end format=raw requests. J2StoreControllerCarts already scoped remove() to the caller's own session, but never overrode the generic FOF save task, so it remained reachable to insert new cart rows with an attacker-chosen user_id/session_id, or overwrite an existing row by id.

Impact: Anonymous cart poisoning and cross-account/session interference, verified against a live test installation (row created and then overwritten via a reused id).

4. Guest checkout address disclosure to any authenticated user (IDOR)

CVE: 2026-78065
Task: GET com_j2store / view=myprofile / task=editAddress
CVSS:4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N / Base Score: 7.1 / Severity: High
CWE: CWE-639 — Authorization Bypass Through User-Controlled Key
File: components/com_j2store/controllers/myprofile.php

editAddress() redirected non-owners away only when the loaded address row had a non-empty user_id belonging to someone else. Guest-checkout address rows have an empty user_id, so that check never triggered for them — any logged-in account guessing a small, sequential address_id got a guest customer's full name, street address, and phone number rendered prefilled into the edit form.

Impact: Personal data disclosure (PII leak) to any registered site user, requiring only ordinary login and address-id enumeration.

5. Missing authorization on Apps controller delegation chain (exploitable by any authenticated backend user)

CVE: 2026-78069
Task: GET com_j2store / view=apps / task=view / appTask=<plugin-task>
CVSS:4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H / Base Score: 9.4 / Severity: Critical
CWE: CWE-862, CWE-73, CWE-22
Files: administrator/components/com_j2store/controllers/apps.php, administrator/components/com_j2store/fof.xml, plugins/j2store/app_localization_data/app_localization_data/models/applocalizationdata.php

J2StoreControllerApps's appTask delegation path instantiates app-plugin controllers with no com_j2store-specific ACL check anywhere in the code. fof.xml's <backend> node — the only node FOF loads for this admin-side controller — has no <view> ACL entries at all, so the framework's default for an unmatched task is allow, not deny. The only reason anonymous visitors can't reach this today is Joomla core's own administrator-login wall, which is unrelated to J2Store; it blocks guests before any component code runs, but does nothing to check com_j2store permissions for a user who is already logged into the backend for any reason.

Impact: Exploitable today, in production, by any authenticated Joomla backend user, regardless of whether they hold any com_j2store permission — e.g. an account that only manages an unrelated component. That user can trigger arbitrary #__j2store_* table truncation and traversal-based SQL file execution. This is a privilege-escalation issue: a low-value backend login (any) becomes a path to data destruction and potential code execution. It is not exploitable by unauthenticated visitors, which is why PR:L rather than PR:N.

Who Is Affected

Any J2Store installation on 3.3.21 or earlier, 4.0.21 or earlier, or 4.1.6 or earlier, where:

• PayPal is enabled as a payment method (issue 1)
• The storefront is publicly accessible (issues 1, 2, 3 require no authentication)
• Any customer account can log in (issue 4 requires only an ordinary login)
• Guest checkout is used and stores addresses (issue 4)
• More than one Joomla backend/administrator account exists, of any privilege level (issue 5 requires a backend login, but not one with any com_j2store permission)

Actions Required

Backup your site. Update to J2Store 3.3.22 if you are still on Joomla 3, 4.0.22 if you run 4.0.x, or 4.1.7 if you run 4.1.x, as soon as the relevant release is available. No configuration changes or workarounds are required beyond installing the update.

If you are unable to update immediately:

• Issue 1: Disable PayPal, or monitor pending orders for unexpected CONFIRMED/FAILED transitions with no matching PayPal transaction.
• Issue 2: If your hosting provider offers a WAF, block requests to view=producttags containing ", <, or onfocus=/autofocus in filter_tag, pricefrom, or priceto.
• Issue 3: There is no frontend toggle; if a WAF is available, block anonymous POST requests to view=carts&task=save.
• Issue 4: Disable guest checkout, or restrict myprofile access to reduce the pool of accounts that can enumerate address_id.
• Issue 5: Review who has any Joomla backend/administrator login on the site — including accounts scoped to unrelated components — and remove or suspend any you don't fully trust until you update. Do not edit the apps/appstores blocks in fof.xml, and do not add or loosen backend user accounts, until the update is applied.

Credits

Phil Taylor (mySites.guru) — discovery and responsible disclosure of all five issues.

Thank you to the Joomla Security Strike Team for their help in the matter.