Executive brief
J2Store is a popular eCommerce extension for Joomla websites that handles online orders and digital product sales. An attacker who obtains the Joomla site's secret key can forge valid access tokens for any order on the site, gaining unauthorized access to order details and purchased digital downloads. Since tokens are never rotated, this exposure persists indefinitely even after the initial secret disclosure is patched, creating a lasting security gap.
Technical details
The vulnerability is a cryptographic weakness in the order access token generation mechanism. J2Store uses a predictable/forgeable token scheme that depends on the Joomla site's secret key; an attacker who possesses this secret can compute valid tokens for arbitrary orders without authentication. The attack requires prior knowledge of the site's Joomla secret (obtained through a separate vulnerability vector), giving it high attack complexity. Successful exploitation grants guest access to sensitive order data and digital downloads. The token is never refreshed, meaning the exposure cannot be remediated by patching the secret-disclosure vector alone—the Joomla secret itself must be rotated.
Affected products
- J2Commerce J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
Timeline
- 2026-09-15: disclosed