CVE-2026-81567

J2Store, a widely used e-commerce extension for Joomla from j2commerce.com, contains an unauthenticated blind SQL injection flaw in the storefront product list, reachable on any public shop that exposes the standard product listing or product-tags filter. An attacker with no account can craft malicious filter/listing requests and use boolean- or time-based inference to slowly extract arbitrary database content, including customer records, order data, and stored credentials or tokens. All shops running J2Store versions 1.0.0-3.3.2, 4.0.0-4.0.22, or 4.1.0-4.1.7 are affected because the vulnerable endpoint sits on the public-facing storefront, requiring no authentication or user interaction. The issue is rated high severity (CVSS 4.0: 8.7) with high impact on confidentiality of the shop database. No public proof-of-concept exists, the flaw is not on the CISA KEV list, and no exploitation in the wild has been reported as of this analysis.

What to do: Upgrade J2Store immediately to a release outside the affected ranges (later than 4.1.7, or a patched build of your current branch). Until patched, apply WAF rules that filter SQL metacharacters on the product-list and product-tags filter parameters, and verify that the database account used by Joomla has least-privilege access. Review web server and database logs for anomalous, repetitive or slow-responding requests to storefront product listing/filter URLs as signs of blind SQL injection probing, and rotate any credentials, tokens, or secrets stored in the database if compromise is suspected.