The J2Store extension for Joomla is vulnerable to a critical authorization bypass that enables unauthenticated remote code execution and database manipulation.

The J2StoreControllerApps component lacks proper access control checks, allowing unauthenticated users to influence table names and file paths. This flaw facilitates path traversal, enabling the execution of arbitrary SQL files and the unauthorized truncation of internal database tables.

The vulnerability carries a CVSS score of 9.5, reflecting its critical potential for full system compromise. An attacker can leverage this flaw to gain complete control over the Joomla database, leading to total data exfiltration, service disruption, and the potential for persistent backdoors within the web application environment.

Immediate Action: Review the official j2commerce.com security advisories and apply the latest available version or security patch for J2Store immediately.

Proactive Monitoring: Inspect server and database logs for anomalous file access patterns, especially requests targeting the appTask delegation path or unexpected SQL file executions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized access to the J2StoreControllerApps endpoint and restrict directory traversal attempts.

Public Exploit Available: No (exploit_available: false)

Given the critical nature of this vulnerability and the potential for remote code execution without authentication, organizations using the J2Store extension must prioritize this update. If a patch cannot be applied immediately, consider disabling the vulnerable extension to prevent potential compromise of the underlying Joomla installation.