Executive brief
J2Store is a popular Joomla eCommerce extension that processes online payments. An attacker can forge PayPal payment notifications to confirm orders without payment, or sabotage other customers' orders by marking them as failed. This could allow fraudsters to obtain products or services for free, and disrupt legitimate customers' purchases.
Technical details
The vulnerability exists in the PayPal IPN (Instant Payment Notification) listener's verification logic. The `_validateIPN()` function accepts `UNVERIFIED` responses and any non-`INVALID` result as valid, making SSL verification requests with `CURLOPT_SSL_VERIFYPEER` disabled, and storing the verdict in an unused field that downstream processing never checks. Additionally, the paid-amount comparison only executes when `mc_gross` is positive; omitting the field bypasses the check entirely via `floatval(null) == 0`. Combined with an enumerable sequential order ID and the merchant-configured receiver email, an unauthenticated attacker can POST a forged IPN to move a pending order to `CONFIRMED` status with no actual payment, or force another customer's order to `FAILED` status. The PayPal v2 plugin (`paypalv2.php`) performs no amount verification under any circumstances. No authentication is required; the attack is network-accessible.
Affected products
- j2commerce.com J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6
Timeline
- 2026-09-03: disclosed