The J2Store extension for Joomla contains a high-severity authorization bypass vulnerability that allows unauthenticated attackers to manipulate cart records and potentially hijack user sessions.

This is an authorization bypass flaw (CWE-639) where the extension fails to properly restrict the FOF framework's generic save task. Because the application does not enforce CSRF tokens on front-end raw requests and grants wildcard ACL permissions, an unauthenticated attacker can insert or overwrite cart rows by specifying arbitrary user or session identifiers.

This vulnerability poses a significant risk to e-commerce operations, as it allows unauthorized modification of shopping cart data. An attacker could overwrite existing orders, redirect shipments, or inject unauthorized items, leading to financial loss, customer data compromise, and severe reputational damage. With a CVSS score of 8.8, this flaw is considered high-risk due to the lack of required authentication or user interaction.

Immediate Action: Review the official J2Store vendor advisory for the release of a security patch and apply it immediately upon availability. If no patch is currently available, assess the business necessity of the extension and consider temporary deactivation.

Proactive Monitoring: Monitor Joomla access logs for unusual requests targeting the J2Store controller, specifically looking for format=raw requests and abnormal save task activity.

Compensating Controls: Implement Web Application Firewall (WAF) rules to block suspicious requests directed at the J2Store cart controller that lack valid session context or originate from non-standard sources.

Public Exploit Available: No — there is no confirmed public exploit or weaponized code available in the provided data.

Given the high CVSS score and the ease of exploitation, security teams should prioritize the identification of all Joomla instances running the affected J2Store versions. Coordinate with the development team to apply vendor-supplied updates as soon as they are released to prevent potential data integrity compromises.