Security
J2Commerce fixes voucher reuse flaw in version 6.6.6
J2Commerce 6.6.6 fixes a checkout race condition that could let a logged-in customer use one gift voucher or single-use coupon across multiple orders.
mySites.guru reported that J2Commerce versions 6.0.0 through 6.6.5 are affected. The CVE record refers to the product as the J2Store extension for Joomla, but the 6.x line is distributed as J2Commerce by J2Commerce, LLC.
Tracked as CVE-2026-102803, the flaw is a CWE-367 time-of-check to time-of-use race condition. A customer account could hold several checkouts at the confirmation stage before submitting them, causing each order to see the voucher’s full balance or a single-use coupon’s unused allowance. The issue is rated Medium, with a CVSS 4.0 score of 6.0.
The problem affects shop revenue rather than confidentiality or site availability. No exploitation has been reported, and the issue is not listed in CISA’s Known Exploited Vulnerabilities catalogue.
Administrators should update to 6.6.6. They should also review recent orders for repeated use of the same gift voucher or single-use coupon, particularly where orders were placed close together.
Originally reported by mySites.guru.