CVE-2026-77999

J2Store, a shopping-cart extension for Joomla, mishandles PayPal IPN callbacks: its `_validateIPN()` check treats any response other than a literal `INVALID` (including `UNVERIFIED`) as success, disables TLS peer verification (`CURLOPT_SSL_VERIFYPEER` off) on the verification call, and stores the verdict in a field that nothing downstream ever reads, so order processing proceeds regardless of the outcome. An unauthenticated attacker can send a forged callback POST using the sequential, enumerable order ID taken from the `custom` field and omitting `mc_gross` (which skips the paid-amount comparison entirely, since `floatval(null) == 0`), thereby marking any pending order as CONFIRMED with no payment or forcing another customer's pending order to FAILED; the `paypalv2.php` endpoint performs no amount check under any circumstances. The attacker gains fraudulent order confirmations that can lead merchants to ship goods for never-paid orders and can enumerate and tamper with other pending orders, with no confidentiality or availability impact (CVSS 4.0 8.7, integrity-only). Any Joomla site running J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, or 4.1.0-4.1.6 is affected, with sites actively processing PayPal payments through the extension directly exploitable. No public proof-of-concept is known, the flaw is not in CISA's KEV, and EPSS is 0.3% (17th percentile), so no confirmed exploitation is currently known.

What to do: Upgrade J2Store to a release beyond the listed ranges (later than 4.1.6); until patched, disable the PayPal/IPN payment method in J2Store or manually reconcile every new CONFIRMED order against actual PayPal transactions before fulfillment. Audit recent orders for pending-to-CONFIRMED transitions lacking matching PayPal payments and for unexpected FAILED flips, since the sequential order IDs allow bulk forged callbacks.