CVE-2026-77999 Business logic in J2Store extension for Joomla
Attackers can forge PayPal callbacks to fraudulently confirm orders or fail others without payment due to flawed IPN validation logic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-77999?
CVE-2026-77999 is a high-severity vulnerability in j2commerce.com J2Store extension for Joomla, published on 3 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - The PayPal IPN listener's signature check (`_validateIPN()`) accepted `UNVERIFIED` and any non-`INVALID` response as valid, made its verification request with `CURLOPT_SSL_VERIFYPEER` disabled, and stored its verdict in a field nothing downstream ever checked — so processing continued regardless of the outcome. Separately, the paid-amount comparison only ran when `mc_gross` was a positive number; omitting the field from the POST body (`floatval(null) == 0`) skipped the check entirely. Combined with a merchant-configured `receiver_email` and a sequential, enumerable order id read from the `custom` field, an anonymous POST was enough to move a pending order straight to `CONFIRMED` with no payment, or force another customer's pending order to `FAILED`. `paypalv2.php` performed no amount check under any circumstances.
Which versions are affected by CVE-2026-77999?
How do I fix CVE-2026-77999?
No fix has been published for CVE-2026-77999 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-77999 being exploited?
There is no known exploitation of CVE-2026-77999 in the wild and no public exploit code.
Sources
Also known as GHSA-ffqf-m6vh-866w.