CVE-2026-78081

Received Received - Intake

CSRF in J2Store for Joomla Extension

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: Joomla! Project

Description

Joomla Extension - j2commerce.com - Missing CSRF protection on cart, checkout and myprofile controllers in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - A forged request riding a victim's active checkout session could silently overwrite the billing or shipping address before order confirmation — the most consequential sub-case, since it opens the door to redirecting a paid order's goods to an attacker-controlled address — or tamper with a saved profile address via `saveAddress()`. As before, each forged request executes with only the victim's own session privileges, so there is no cross-account data access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-15

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-05

NVD

CVE-2026-78081

EUVD

EUVD-2026-79293

Affected Vendors & Products

Vendor	Product	Version / Range
j2commerce	j2store	From 1.0.0 (inc) to 3.3.2 (inc)
j2commerce	j2store	From 4.0.0 (inc) to 4.0.22 (inc)
j2commerce	j2store	From 4.1.0 (inc) to 4.1.7 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) flaw in the J2Store Joomla extension versions 1.0.0-3.3.2, 4.0.0-4.0.22, and 4.1.0-4.1.7. It allows an attacker to trick a user into executing unwanted actions during an active checkout session, such as changing billing or shipping addresses before order confirmation. The attacker can redirect paid orders to their own address or modify saved profile addresses without needing elevated privileges.

Impact Analysis

If you use a vulnerable version of J2Store, an attacker could hijack your checkout session to alter order details, leading to financial loss or stolen goods. Even saved profile addresses could be tampered with, affecting future orders. The attack requires tricking you into clicking a malicious link while logged into your store.

Compliance Impact

This vulnerability could lead to unauthorized modifications of billing or shipping addresses during checkout, potentially violating data integrity and privacy requirements under GDPR and HIPAA. Unauthorized address changes may result in improper handling of personal data, such as shipping to incorrect locations, which could expose sensitive customer information to unauthorized parties.

Mitigation Strategies

Update J2Store to the latest patched version immediately. Disable guest checkout if enabled. Review order addresses for any unauthorized changes. Monitor network traffic for suspicious checkout session modifications.

Hi! I’m here to help you understand CVE-2026-78081. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70