CVE-2026-81567: Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated, blind extraction of arbitrary database content (e.g. customer records, order data, stored credentials/tokens) via boolean- or time-based inference, reachable on any public storefront that exposes the standard product listing or product-tags filter.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
Any public storefront running an affected J2Store version is exposed if it presents the standard product listing or product-tags filter. The issue does not require authentication.
What does an attacker need to exploit this issue?
An attacker only needs network access to a reachable public storefront endpoint that exposes the affected listing or tag-filter functionality. Exploitation uses boolean- or time-based inference, so database content can be extracted without direct query results being displayed.
What data could be at risk?
The vulnerability permits blind extraction of arbitrary database content. Examples identified include customer records, order data, and stored credentials or tokens.