CVE-2026-82189

J2Store, a Joomla e-commerce extension from j2commerce.com, contains an unauthenticated flaw in its order-status handling: an attacker who can reach the storefront can send a crafted status-update request for any order without authenticating or supplying valid payment or transaction data. The impact is a denial of service against the order pipeline — pending orders can be mass-flipped to FAILED to disrupt revenue and force manual reprocessing, and already-fulfilled orders can be reverted to FAILED, triggering unwarranted refunds, cancellations, and customer-support load. The root cause maps to CWE-472 (trust of assumed-immutable web parameters) and CWE-602 (client-side/server-side enforcement mismatch) on the order-status update flow. Every released version is affected — 1.0.0-3.3.2, 4.0.0-4.0.22, and 4.1.0-4.1.7 — earning a CVSS 4.0 score of 8.7 (high), though with no integrity impact beyond order state. Exploitation status: no public PoC and no known in-the-wild attacks, but the flaw is trivially discoverable by anyone probing a Joomla store.

What to do: Update J2Store to a release newer than the affected ranges — i.e., beyond 4.1.7 on the current line, or the latest available build for sites still on the 3.x/4.0.x branches — since all prior versions are vulnerable. Audit order history for unexplained FAILED transitions and reconcile order states against payment-gateway records before issuing any refunds or cancellations. Until patched, apply a WAF rule or rate limit to block and log unauthenticated requests hitting order-status update endpoints.