Order Content Disclosure in J2Store by J2Commerce

CVE-2026-67359

What is CVE-2026-67359?

The J2Store extension by J2Commerce is vulnerable to order content disclosure, allowing unauthenticated users to access sensitive checkout information. By manipulating the 'order_id' query parameter, an attacker can retrieve the entire checkout confirmation page, exposing details such as line items, prices, and totals. This vulnerability highlights the importance of securing sensitive data and ensuring that sensitive checkout pages are not accessible without proper authentication.

References