CVE-2026-82191: Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - A crafted link to the paypal notify endpoint, if followed by a victim's browser (or an automated system that fetches it), causes the resulting redirect to comj2store's checkout controller to carry attacker-chosen query parameters instead of only the intended view=checkout&task=confirmPayment&orderpaymenttype=...&paction=process set — parameter injection/smuggling into that follow-up request. This requires a victim to load the crafted link (UI:R/UI:P); it does not by itself grant an unauthenticated attacker anything they could not already obtain by requesting the target comj2store URL directly with their own parameters.
Affected Software
Event History
Frequently Asked Questions
Which J2Store releases are affected?
Affected releases are J2Store 1.0.0 through 3.3.2, 4.0.0 through 4.0.22, and 4.1.0 through 4.1.7.
What must happen for exploitation to occur?
A victim browser, or an automated system that fetches URLs, must load an attacker-crafted link to the PayPal notify endpoint. The issue relies on that follow-up redirect carrying attacker-chosen query parameters.
Does this issue alone give an unauthenticated attacker new access?
No. By itself, it does not allow an unauthenticated attacker to obtain anything they could not already obtain by directly requesting the target com_j2store URL with their own parameters.