CVE-2026-67359— Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud StorageAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| j2commerce.com | J2Store extension for Joomla | 1.0.0-3.3.20 | affected |
4.0.0-4.0.20 | affected | ||
4.1.0-4.1.5 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-67359
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
Source: CVE Program / CVE List V5
Vulnerability Description
Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any order_id as a query parameter to render the full checkout confirmation page for that order, including line items, prices, and totals.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| j2commerce.com | J2Store extension for Joomla | 1.0.0-3.3.20 | - |
II. Public POCs for CVE-2026-67359
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-67359
请登录查看更多情报信息。
Vendor Pages for CVE-2026-67359 (1)
Same Patch Batch · j2commerce.com · 2026-08-21 · 6 CVEs total
| CVE-2026-74252 | 8.6 HIGH | Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, |
| CVE-2026-67361 | 6.9 MEDIUM | Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory pro |
| CVE-2026-67360 | 6.3 MEDIUM | Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3. |
| CVE-2026-67358 | 5.3 MEDIUM | Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4 |
| CVE-2026-67362 | 5.1 MEDIUM | Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3. |
IV. Related Vulnerabilities
Same product: J2Store extension for Joomla
- CVE-2026-67361
Joomla Extension - j2commerce.com - Unauthenticated file upl - CVE-2026-74252
Joomla Extension - j2commerce.com - Stored XSS in Guest chec - CVE-2026-67358
Joomla Extension - j2commerce.com - Download quota manipulat - CVE-2026-67362
Joomla Extension - j2commerce.com - Open redirect in cart co - CVE-2026-67360
Joomla Extension - j2commerce.com - Cross-customer order rep
Same vendor: j2commerce.com
- CVE-2026-67361
Joomla Extension - j2commerce.com - Unauthenticated file upl - CVE-2026-74252
Joomla Extension - j2commerce.com - Stored XSS in Guest chec - CVE-2026-67358
Joomla Extension - j2commerce.com - Download quota manipulat - CVE-2026-67362
Joomla Extension - j2commerce.com - Open redirect in cart co - CVE-2026-67360
Joomla Extension - j2commerce.com - Cross-customer order rep
Same weakness: CWE-639
- CVE-2026-62283
Nezha Monitoring: Cross-tenant terminal/file-manager session - CVE-2026-67358
Joomla Extension - j2commerce.com - Download quota manipulat - CVE-2026-67360
Joomla Extension - j2commerce.com - Cross-customer order rep - CVE-2026-77780
Unvalidated bank account and card foreign keys in the Prospe - CVE-2026-77759
IDOR and missing authorization in the Prospero Flow CRM tran
V. Comments for CVE-2026-67359
No comments yet