CVE-2026-77999 Details
Description
Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - The PayPal IPN listener's signature check (`_validateIPN()`) accepted `UNVERIFIED` and any non-`INVALID` response as valid, made its verification request with `CURLOPT_SSL_VERIFYPEER` disabled, and stored its verdict in a field nothing downstream ever checked — so processing continued regardless of the outcome. Separately, the paid-amount comparison only ran when `mc_gross` was a positive number; omitting the field from the POST body (`floatval(null) == 0`) skipped the check entirely. Combined with a merchant-configured `receiver_email` and a sequential, enumerable order id read from the `custom` field, an anonymous POST was enough to move a pending order straight to `CONFIRMED` with no payment, or force another customer's pending order to `FAILED`. `paypalv2.php` performed no amount check under any circumstances.
A vulnerability exists in the J2Store eCommerce extension for Joomla, specifically in versions 1.0.0 through 3.3.21, 4.0.0 through 4.0.21, and 4.1.0 through 4.1.6. This vulnerability allows for unauthenticated PayPal callback forgery, leading to fraudulent order confirmations. The issue arises because the PayPal IPN listener's signature validation accepted 'UNVERIFIED' and any response that was not 'INVALID' as valid. Additionally, the verification request was made with SSL peer verification disabled, and the result was stored in a field that was never checked downstream, allowing processing to continue regardless of the verification outcome. Furthermore, the paid-amount comparison only occurred when 'mc_gross' was a positive number, creating a loophole that could be exploited by omitting the field from the POST body. By combining a merchant-configured 'receiver_email' with a sequential, enumerable order ID from the 'custom' field, an anonymous POST could be used to confirm an order without payment or to disrupt another customer's order.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 3, 2026CISA-ADP
Assessed Sep 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.j2commerce.com/ | [email protected] | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-472 | External Control of Assumed-Immutable Web Parameter | [email protected] |
| CWE-602 | Client-Side Enforcement of Server-Side Security | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| J2Commerce J2Store | >= 1.0.0, <= 3.3.21 (semver) >= 4.0.0, <= 4.0.21 (semver) >= 4.1.0, <= 4.1.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 3, 2026 | New CVE Received | [email protected] |
| Sep 3, 2026 | CVE Modified | CISA-ADP |