# CVE-2026-78081: J2Commerce J2Store missing CSRF protection in checkout controllers

Source: https://junglewise.ai/threats/cve-2026-78081-j2commerce-j2store-missing-csrf-protection-in-checkout  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-78081 · Severity: info · Published 2026-09-15

J2Store is a popular Joomla eCommerce extension used by online retailers to build and manage shopping carts and storefronts. A missing CSRF protection vulnerability in the cart, checkout, and user profile controllers allows an attacker to forge requests that silently change a customer's billing or shipping address before order confirmation—potentially redirecting a paid order to the attacker's address. The vulnerability affects customers during active checkout sessions and could result in order fraud or goods diversion.

Technologies: [J2commerce.Com J2Store](https://junglewise.ai/threats/technologies/j2store). Vendors: [J2commerce.Com](https://junglewise.ai/threats/vendors/j2commerce-com).

## Quick answers

**Is CVE-2026-78081 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78081 being exploited in the wild.

**How severe is CVE-2026-78081?** Informational severity, published 15 September 2026.

**Which products and versions are affected?** J2commerce.Com J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7.

**Is there a fix for CVE-2026-78081?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-78081 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-78081?** Check whether you run J2commerce.Com J2Store at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing Cross-Site Request Forgery (CSRF) protection flaw affecting the cart, checkout, and myprofile controllers in J2Store. An attacker can craft a malicious webpage or email that, when visited by a victim with an active J2Store session, triggers state-changing requests (e.g., via saveAddress() method) without valid anti-CSRF tokens. The attack vector is network-based and requires the victim's active session to an e-commerce site; no authentication bypass is involved since requests execute with the victim's own privileges. An attacker can alter billing/shipping addresses before order finalization, redirecting goods to an attacker-controlled location or modifying stored profile data. The vulnerability affects J2Store versions 1.0.0 through 3.3.2, 4.0.0 through 4.0.22, and 4.1.0 through 4.1.7; patch status is not indicated in the advisory.

## Affected products

- j2commerce.com J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7

## Timeline

- 2026-09-15: disclosed

## References

- [https://www.j2commerce.com/](https://www.j2commerce.com/)

## Related threats

- [J2Store PayPal parameter injection in redirect](https://junglewise.ai/threats/cve-2026-82191-j2store-paypal-parameter-injection-in-redirect)
- [J2Store order status manipulation via unauthenticated request](https://junglewise.ai/threats/cve-2026-82189-j2store-order-status-manipulation-via-unauthenticated-request)
- [J2Store SQL injection in storefront product list](https://junglewise.ai/threats/cve-2026-81567-j2store-sql-injection-in-storefront-product-list)
- [J2Store missing authorization in Apps controller](https://junglewise.ai/threats/cve-2026-78069-j2store-missing-authorization-in-apps-controller)
- [J2Store guest checkout address disclosure via IDOR](https://junglewise.ai/threats/cve-2026-78065-j2store-guest-checkout-address-disclosure-via-idor)