CVE-2026-77999: Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6
Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - The PayPal IPN listener's signature check (validateIPN()) accepted UNVERIFIED and any non-INVALID response as valid, made its verification request with CURLOPTSSLVERIFYPEER disabled, and stored its verdict in a field nothing downstream ever checked — so processing continued regardless of the outcome. Separately, the paid-amount comparison only ran when mcgross was a positive number; omitting the field from the POST body (floatval(null) == 0) skipped the check entirely. Combined with a merchant-configured receiveremail and a sequential, enumerable order id read from the custom field, an anonymous POST was enough to move a pending order straight to CONFIRMED with no payment, or force another customer's pending order to FAILED. paypalv2.php performed no amount check under any circumstances.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
J2Store (j2commerce.com) PayPalv2 IPN/paypalv2.phpto a version that resolves this vulnerability.Fixed in 1.0.0-3.3.21 - Upgrade
Upgrade
J2Store (j2commerce.com) PayPalv2 IPN/paypalv2.phpto a version that resolves this vulnerability.Fixed in 4.0.0-4.0.21 - Upgrade
Upgrade
J2Store (j2commerce.com) PayPalv2 IPN/paypalv2.phpto a version that resolves this vulnerability.Fixed in 4.1.0-4.1.6 - Configuration
Update the PayPal IPN listener signature-check logic so that _validateIPN() does not accept UNVERIFIED (and does not treat any non-INVALID response as valid), and ensure that processing of order state changes only proceeds when the verification verdict is explicitly checked and indicates verification success.
J2Store PayPal IPN listener (paypalv2.php) _validateIPN() IPN signature verification handling = Reject UNVERIFIED and accept only valid/verified response; ensure downstream processing checks the verification verdict - Configuration
Modify _validateIPN() to perform the verification request with CURLOPT_SSL_VERIFYPEER enabled (do not disable TLS certificate verification).
J2Store PayPal IPN listener _validateIPN() CURLOPT_SSL_VERIFYPEER = enabled - Configuration
Fix the paid-amount comparison so it runs regardless of whether mc_gross is present and does not allow skipping the check by omitting the field from the POST body.
J2Store PayPal IPN listener (paypalv2.php) paid-amount comparison mc_gross presence/validation = always require mc_gross and enforce amount check
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it by sending a crafted POST to the PayPal IPN listener. Exploitation relies on knowing or enumerating a pending order ID from the custom field and using the merchant-configured receiver_email.
Are all affected J2Store branches exposed in the same way?
The affected versions are J2Store 1.0.0 through 3.3.21, 4.0.0 through 4.0.21, and 4.1.0 through 4.1.6. The paypalv2.php listener is particularly exposed because it performs no amount check under any circumstances.
What outcomes should defenders look for when assessing impact?
Look for pending orders that were moved to CONFIRMED without a corresponding payment, as well as pending orders changed to FAILED. The issue can be triggered by forged PayPal callback requests, including requests that omit mc_gross to bypass the amount comparison in the affected listener.