Executive brief
J2Store is a popular eCommerce extension for Joomla websites that handles online orders and payments. An unauthenticated attacker can mark any order as failed without permission, allowing mass disruption of pending orders to prevent revenue capture, or flipping already-completed orders back to failed status to cause operational confusion and force manual reprocessing. This vulnerability enables attackers to disrupt order processing and customer operations without authentication or access controls.
Technical details
The vulnerability is an unauthenticated authorization bypass in J2Store's order status update mechanism. An attacker can submit requests to mark arbitrary orders as failed without providing correct payment data, transaction identifiers, or authentication credentials. The affected versions (1.0.0–3.3.2, 4.0.0–4.0.22, 4.1.0–4.1.7) lack proper access controls on order state transitions. The attack requires only network access to the Joomla site and knowledge of an order identifier. Impact includes denial of service against the order pipeline, disruption of revenue capture, operational confusion (unwarranted refunds and cancellations), and increased customer support load. No patch information is provided in the advisory.
Affected products
- j2commerce.com J2Store 1.0.0–3.3.2, 4.0.0–4.0.22, 4.1.0–4.1.7
Timeline
- 2026-09-15: disclosed