Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7

Description

Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated denial-of-service against the order pipeline: mass-failing pending orders to disrupt revenue and force manual reprocessing, or flipping already-fulfilled orders back to `FAILED` to cause operational confusion (unwarranted refunds/cancellations, customer-support load). Unlike the earlier confirmation-fraud issue, this required no correct payment amount or transaction data at all.

Timeline

Scores

EPSS (exploitation in 30 days)

0.43% · top 63% of all CVEs (7 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.7.

Weakness

• CWE-472: External Control of Assumed-Immutable Web Parameter (opens in a new tab)All about CWE-472 and its CVEs
• CWE-602: Client-Side Enforcement of Server-Side Security (opens in a new tab)All about CWE-602 and its CVEs

Affected products

• j2commerce.com · J2Store extension for Joomla

  • affected 1.0.0-3.3.22
  • affected 4.0.0-4.0.22
  • affected 4.1.0-4.1.7

References (1)

• https://www.j2commerce.com/ (opens in a new tab)product

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-82189](https://trackcve.app/badge/CVE-2026-82189.svg)](https://trackcve.app/cve/CVE-2026-82189)

Record last updated 16 Sept 2026, 05:58 UTC.