Executive brief
J2Store is a popular Joomla eCommerce extension used by online retailers to build and manage shopping carts and storefronts. A missing CSRF protection vulnerability in the cart, checkout, and user profile controllers allows an attacker to forge requests that silently change a customer's billing or shipping address before order confirmation—potentially redirecting a paid order to the attacker's address. The vulnerability affects customers during active checkout sessions and could result in order fraud or goods diversion.
Technical details
The vulnerability is a missing Cross-Site Request Forgery (CSRF) protection flaw affecting the cart, checkout, and myprofile controllers in J2Store. An attacker can craft a malicious webpage or email that, when visited by a victim with an active J2Store session, triggers state-changing requests (e.g., via saveAddress() method) without valid anti-CSRF tokens. The attack vector is network-based and requires the victim's active session to an e-commerce site; no authentication bypass is involved since requests execute with the victim's own privileges. An attacker can alter billing/shipping addresses before order finalization, redirecting goods to an attacker-controlled location or modifying stored profile data. The vulnerability affects J2Store versions 1.0.0 through 3.3.2, 4.0.0 through 4.0.22, and 4.1.0 through 4.1.7; patch status is not indicated in the advisory.
Affected products
- j2commerce.com J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
Timeline
- 2026-09-15: disclosed