The J2Store extension for Joomla suffers from a CSRF vulnerability (CWE-352) in its cart, checkout, and myprofile controllers across specified versions. This vulnerability allows an attacker to craft malicious requests that, when executed by an authenticated user, can silently modify billing or shipping addresses during checkout or alter saved profile addresses via the saveAddress() function. The attack leverages the victim's session privileges but does not grant access to other users' data. The CVSS 4.0 score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on integrity.

Successful exploitation can lead to unauthorized modification of billing or shipping addresses during the checkout process, potentially redirecting paid orders to attacker-controlled addresses. Additionally, attackers can tamper with saved profile addresses. However, the attack is limited to the victim's own session and does not allow cross-account data access.

No explicit patch or remediation information is provided in the vendor advisory or source data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious of unsolicited links or requests while authenticated in J2Store. Implementing CSRF protections such as anti-CSRF tokens in affected controllers is recommended once patches are released.