Security
J2Store fixes six security flaws across all supported branches
J2Commerce has fixed six security vulnerabilities in J2Store, including an unauthenticated SQL injection that could expose a shop’s database.
The issues were privately reported by mySites.guru and affect J2Store 3.3.22 and earlier, 4.0.22 and earlier, and 4.1.7 and earlier. They are fixed in versions 3.3.23, 4.0.23 and 4.1.8 respectively.
CVE-2026-81567: unauthenticated blind SQL injection in public product listings, rated 8.7 High.CVE-2026-81568: arbitrary file read through the download handler, rated 8.7 High.CVE-2026-82189: unauthenticated requests could mark orders as Failed, rated 8.7 High.CVE-2026-78081: incomplete CSRF protection in checkout and profile controllers, rated 7.1 High.CVE-2026-82190: predictable order access tokens, rated 6.3 Medium.CVE-2026-82191: unescaped request data in the PayPal notify redirect, rated 5.3 Medium.
J2Commerce reports no evidence that the flaws were exploited on live stores. Administrators should back up and update through Joomla’s update system. Custom checkout or profile overrides and add-ons may need the new CSRF token added; test these changes first to avoid Invalid Token errors.
Originally reported by mySites.guru.