CVE-2026-77999: CWE-472: External Control of Assumed-Immutable Web Parameter in j2commerce.com J2Store extension for Joomla

CVE-2026-77999 affects the J2Store extension for Joomla in versions 1.0.0 through 3.3.21, 4.0.0 through 4.0.21, and 4.1.0 through 4.1.6. The vulnerability arises because the PayPal IPN listener's signature validation function (_validateIPN()) accepts 'UNVERIFIED' and any non-'INVALID' responses as valid, disables SSL peer verification during verification requests, and stores the verification result in a field that downstream processes never check. Additionally, the paid-amount comparison only executes if the 'mc_gross' field is a positive number; omitting this field bypasses the check. Using a merchant-configured receiver_email and predictable order IDs from the 'custom' field, an attacker can send anonymous POST requests to move pending orders to CONFIRMED status without payment or cause other orders to fail. The paypalv2.php script does not perform any amount checks. This combination of flaws leads to unauthenticated PayPal callback forgery and order confirmation fraud.

An attacker can fraudulently confirm orders without making any payment or cause legitimate orders to fail by exploiting the improper validation of PayPal IPN callbacks. This undermines the integrity of order processing in affected J2Store versions, potentially resulting in financial loss and disruption of e-commerce operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling PayPal IPN processing or implementing additional validation controls outside the vulnerable code to verify payment authenticity. Monitor vendor communications for official patches or updates.