Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-78081

Joomla Extension - j2commerce.com - Missing CSRF protection on cart, checkout and myprofile controllers in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Joomla

Description

Joomla Extension - j2commerce.com - Missing CSRF protection on cart, checkout and myprofile controllers in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - A forged request riding a victim's active checkout session could silently overwrite the billing or shipping address before order confirmation — the most consequential sub-case, since it opens the door to redirecting a paid order's goods to an attacker-controlled address — or tamper with a saved profile address via `saveAddress()`. As before, each forged request executes with only the victim's own session privileges, so there is no cross-account data access.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

j2commerce.com J2Store extension for Joomla

Default version status: unaffected

  • 1.0.0-3.3.22affected
  • 4.0.0-4.0.22affected
  • 4.1.0-4.1.7affected

References