This vulnerability involves authorization bypass through a user-controlled key (CWE-639) combined with a missing Cross-Site Request Forgery (CSRF) protection (CWE-352) in the J2Store extension for Joomla. Authenticated users can exploit the flaw to increment download counters on records they do not own by leveraging a valid order token. The absence of CSRF tokens on the endpoint further weakens the security posture, allowing potential unauthorized state changes without user consent. The issue affects multiple version ranges of J2Store as specified.

An authenticated user can manipulate download quotas by incrementing counters on download records of other orders, potentially leading to unauthorized access to additional downloads beyond intended limits. The lack of CSRF protection means that attackers could trick authenticated users into performing unwanted actions, increasing the risk of quota manipulation. There is no indication of remote unauthenticated exploitation or direct data disclosure. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authenticated users carefully and monitor for suspicious activity related to download quota manipulation. Implement additional CSRF protections if possible via custom controls or web application firewall rules to mitigate exploitation risk.