CVE-2026-78081

J2Store, a Joomla e-commerce extension from j2commerce.com, ships its cart, checkout, and myprofile controllers without CSRF token checks, so a forged cross-site request can ride a victim's active session and silently overwrite the billing or shipping address before order confirmation — potentially redirecting a paid order's goods to an attacker-controlled address — or tamper with a saved profile address via saveAddress(). The attack requires user interaction (the victim must encounter attacker-controlled content while logged in), but needs no privileges and executes with the victim's own session rights, so there is no cross-account data access. The flaw is rated high severity (CVSS 4.0: 7.1, primarily an integrity impact). Every release of the product is affected: 1.0.0–3.3.2, 4.0.0–4.0.22, and 4.1.0–4.1.7. No public proof of concept exists and no in-the-wild exploitation has been observed.

What to do: Upgrade every J2Store installation to the latest available release, which is newer than the affected ranges (beyond 4.1.7, 4.0.22, and 3.3.2 respectively). As an interim mitigation, enforce SameSite=Lax or Strict on session cookies (the 'cookie_samesite' setting on Joomla 4+) to blunt cross-site forgeries, and review recent orders for shipping or billing address changes made late in checkout that differ from the customer's saved profile.