Vulnerability in Joomla Extension Affecting J2Store Product by j2commerce.com
CVE-2026-102803

6MEDIUM

Key Information:

Vendor

J2commerce.com

Status
J2store Extension For Joomla
Vendor
CVE Published:
10 November 2026

What is CVE-2026-102803?

A vulnerability in the J2Store extension available on j2commerce.com allows logged-in customers to exploit single-use gift vouchers and coupons by redeeming them for multiple orders. This occurs when a customer initiates several checkout sessions simultaneously, as the system fails to correctly track the usage of vouchers or coupon limits across active sessions. As a result, the full balance of a gift voucher or prepaid coupon can be applied to multiple transactions, undermining the intended restrictions of maximum uses for each coupon.

Affected Version(s)

J2Store extension for Joomla 6.0.0-6.6.5

References

https://www.j2commerce.com/
product

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.