The J2Store plugin before 3.3.13 for Joomla! allows a SQL injection attack by a trusted store manager.
Exploitation requires trusted store manager privileges in J2Store. It is not described as exploitable by an unauthenticated or low-privilege user.
An attacker needs network access and valid store manager-level privileges. No user interaction is required once that access is available.
The CVSS vector indicates high impact to confidentiality, integrity, and availability, meaning successful SQL injection may expose, alter, or disrupt affected data and services.
J2Store versions before 3.3.13 are affected. Updating to version 3.3.13 or later addresses the affected version range stated in the advisory.