CVE-2026-82189
Received
Received - Intake
Unauthenticated Denial-of-Service in J2Store Joomla Extension
Vulnerability report for CVE-2026-82189, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-09-15
Last updated on: 2026-09-15
Assigner: Joomla! Project
Description
Description
Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated denial-of-service against the order pipeline: mass-failing pending orders to disrupt revenue and force manual reprocessing, or flipping already-fulfilled orders back to `FAILED` to cause operational confusion (unwarranted refunds/cancellations, customer-support load). Unlike the earlier confirmation-fraud issue, this required no correct payment amount or transaction data at all.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| j2commerce | j2store | From 1.0.0 (inc) to 3.3.2 (inc) |
| j2commerce | j2store | From 4.0.0 (inc) to 4.0.22 (inc) |
| j2commerce | j2store | From 4.1.0 (inc) to 4.1.7 (inc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-472 | The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields. |
| CWE-602 | The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server. |
