Address Disclosure Vulnerability in J2Store by j2commerce.com
CVE-2026-78065

7.1HIGH

Key Information:

Vendor

J2commerce.com

Status
J2store Extension For Joomla
Vendor
CVE Published:
3 September 2026

What is CVE-2026-78065?

The J2Store extension by j2commerce.com has a vulnerability that allows authenticated users to access guest checkout address details due to an Insecure Direct Object Reference (IDOR). This occurs between versions 1.0.0 and 4.1.6, where authenticated users can exploit the editAddress() function to retrieve sensitive user information—such as the full name, street address, and phone number—by merely guessing the sequential address_id. The vulnerability arises as guest checkout rows have an empty user_id, effectively bypassing security checks designed to protect this information. Website administrators should promptly update to the latest version to mitigate this risk.

Affected Version(s)

J2Store extension for Joomla 1.0.0-3.3.21

J2Store extension for Joomla 4.0.0-4.0.21

J2Store extension for Joomla 4.1.0-4.1.6

References

https://www.j2commerce.com/
product

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Phil Taylor, mysites.guru
.