CVE-2026-82191: Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7

Published Sep 15, 2026
·
Updated

Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - A crafted link to the paypal notify endpoint, if followed by a victim's browser (or an automated system that fetches it), causes the resulting redirect to comj2store's checkout controller to carry attacker-chosen query parameters instead of only the intended view=checkout&task=confirmPayment&orderpaymenttype=...&paction=process set — parameter injection/smuggling into that follow-up request. This requires a victim to load the crafted link (UI:R/UI:P); it does not by itself grant an unauthenticated attacker anything they could not already obtain by requesting the target comj2store URL directly with their own parameters.

Affected Software

1 affected component
Joomla Extension (j2commerce.com) - J2Store>=1.0.0<=3.3.2, >=4.0.0<=4.0.22, >=4.1.0<=4.1.7

Event History

Sep 15, 2026
CVE Published
via MITRE·06:50 PM
Data Sourced
via MITRE·06:50 PM
DescriptionWeakness

Frequently Asked Questions

1

Which J2Store releases are affected?

Affected releases are J2Store 1.0.0 through 3.3.2, 4.0.0 through 4.0.22, and 4.1.0 through 4.1.7.

2

What must happen for exploitation to occur?

A victim browser, or an automated system that fetches URLs, must load an attacker-crafted link to the PayPal notify endpoint. The issue relies on that follow-up redirect carrying attacker-chosen query parameters.

3

Does this issue alone give an unauthenticated attacker new access?

No. By itself, it does not allow an unauthenticated attacker to obtain anything they could not already obtain by directly requesting the target com_j2store URL with their own parameters.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203