CVE-2026-77999
Received Received - Intake

Unauthenticated PayPal Callback Forgery in J2Store

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: Joomla! Project

Description
Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - The PayPal IPN listener's signature check (`_validateIPN()`) accepted `UNVERIFIED` and any non-`INVALID` response as valid, made its verification request with `CURLOPT_SSL_VERIFYPEER` disabled, and stored its verdict in a field nothing downstream ever checked — so processing continued regardless of the outcome. Separately, the paid-amount comparison only ran when `mc_gross` was a positive number; omitting the field from the POST body (`floatval(null) == 0`) skipped the check entirely. Combined with a merchant-configured `receiver_email` and a sequential, enumerable order id read from the `custom` field, an anonymous POST was enough to move a pending order straight to `CONFIRMED` with no payment, or force another customer's pending order to `FAILED`. `paypalv2.php` performed no amount check under any circumstances.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-77999
EUVD
EUVD-2026-70415

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
j2commerce j2store From 1.0.0 (inc) to 3.3.21 (inc)
j2commerce j2store From 4.0.0 (inc) to 4.0.21 (inc)
j2commerce j2store From 4.1.0 (inc) to 4.1.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-472 The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.
CWE-602 The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an unauthenticated attacker to forge PayPal callbacks in the J2Store Joomla extension. The flaw exists in the PayPal IPN listener's signature check, which incorrectly accepts unverified responses and disables SSL verification during verification requests. Additionally, the paid-amount comparison is skipped if the POST body omits the mc_gross field, allowing attackers to manipulate order statuses without payment.

Impact Analysis

An attacker could exploit this to fraudulently confirm orders without payment or force other customers' pending orders to fail. This could lead to financial losses, reputational damage, or unauthorized access to order processing systems. The vulnerability requires no authentication, making it accessible to remote attackers.

Compliance Impact

This vulnerability could violate compliance requirements related to data integrity and secure transactions. For GDPR, it may compromise payment data protection. For HIPAA, it could affect the integrity of financial transactions involving protected health information. Organizations using affected J2Store versions may face compliance violations and legal risks.

Mitigation Strategies

Update J2Store to the latest patched version immediately to address the PayPal callback forgery and order confirmation fraud vulnerabilities. Disable the PayPal IPN listener if not in use or restrict access to trusted IPs. Review all pending orders for unauthorized changes and verify payment statuses manually.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77999. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart