CVE-2026-82191 Details
Description
Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - A crafted link to the paypal notify endpoint, if followed by a victim's browser (or an automated system that fetches it), causes the resulting redirect to `com_j2store`'s checkout controller to carry attacker-chosen query parameters instead of only the intended `view=checkout&task=confirmPayment&orderpayment_type=...&paction=process` set — parameter injection/smuggling into that follow-up request. This requires a victim to load the crafted link (`UI:R`/`UI:P`); it does not by itself grant an unauthenticated attacker anything they could not already obtain by requesting the target `com_j2store` URL directly with their own parameters.
A vulnerability in the J2Store extension for Joomla has been identified, allowing for parameter injection into PayPal notification redirects. This issue affects J2Store versions 1.0.0 through 3.3.2, 4.0.0 through 4.0.22, and 4.1.0 through 4.1.7. The vulnerability arises because unescaped request data is reflected into the PayPal notify redirect, enabling an attacker to inject custom query parameters into the checkout controller's follow-up request. While this requires a victim to load the crafted link, it does not provide an unauthenticated attacker with any additional access beyond what could be obtained by directly requesting the target URL with their own parameters.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.j2commerce.com/ | [email protected] | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1241 | Use of Predictable Algorithm in Random Number Generator | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| J2Commerce J2Store | >= 1.0.0, <= 3.3.2 (semver) >= 4.0.0, <= 4.0.22 (semver) >= 4.1.0, <= 4.1.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Sep 15, 2026 | New CVE Received | [email protected] |