Executive brief
J2Store is a Joomla e-commerce plugin that manages online shopping carts and orders. A vulnerability allows authenticated users to access and copy another customer's order details, including cart contents and shipping addresses, by manipulating order IDs during checkout. While CSRF protection is in place, the system fails to verify that the user owns the order they're accessing, enabling data theft and account tampering.
Technical details
The vulnerability is an improper access control flaw in the J2Store checkout/cart replication function. An authenticated attacker can supply an arbitrary order_id parameter to copy another customer's order data into their own session. Although the application validates CSRF tokens, it does not verify ownership of the target order before allowing the operation. The attack requires authentication and network access to the Joomla installation but no additional user interaction. An attacker can access sensitive customer data including cart contents, billing and shipping addresses, and potentially customer identity information. Patches are available in versions after 4.1.5 and in the newer J2Commerce rebranding.
Affected products
- j2commerce.com J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
Timeline
- 2026-08-21: disclosed