Executive brief
J2Store is a popular Joomla eCommerce extension used to build and manage online stores. An unauthenticated attacker can access order confirmation pages for any order by manipulating a query parameter, exposing sensitive customer information including line items, prices, and order totals without requiring login or authorization.
Technical details
This is an information disclosure vulnerability in J2Store's order confirmation page functionality. The vulnerability stems from insufficient access control on the checkout confirmation endpoint, which accepts an arbitrary order_id query parameter without verifying that the requester is authorized to view that order. An unauthenticated attacker can enumerate order IDs and retrieve complete order details including items, pricing, and totals. No authentication or special preconditions are required; the vulnerability is exploitable via direct HTTP requests from the network. The affected versions are J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5.
Affected products
- j2commerce.com J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
Timeline
- 2026-08-21: disclosed