Quick answers
- Is CVE-2026-67362 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-67362 being exploited in the wild.
- How severe is CVE-2026-67362?
- Informational severity, published 21 August 2026.
- Which products and versions are affected?
- J2commerce.Com J2Store 1.0.0–3.3.20, 4.0.0–4.0.20, 4.1.0–4.1.5.
- Is there a fix for CVE-2026-67362?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-67362 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-67362?
- Check whether you run J2commerce.Com J2Store at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an open redirect (CWE-601) in four task handlers of the J2Store cart controller across versions 1.0.0–3.3.20, 4.0.0–4.0.20, and 4.1.0–4.1.5. The handlers accept base64-encoded URLs from user input and redirect to them without validating the destination host. No authentication is required to exploit this. An attacker can craft a malicious URL that base64-encodes a phishing domain, and when a customer clicks the link (which appears to originate from the trusted shop domain), they are redirected to the attacker's site, facilitating credential harvesting and fraud. Patch availability is not noted in the advisory.
Affected products
- j2commerce.com J2Store 1.0.0–3.3.20, 4.0.0–4.0.20, 4.1.0–4.1.5
Timeline
- 2026-08-21: disclosed