The J2Store extension for Joomla contains an unauthenticated blind SQL injection vulnerability (CWE-89) in its storefront product list and product-tags filter. This vulnerability affects multiple version ranges: 1.0.0-3.3.22, 4.0.0-4.0.22, and 4.1.0-4.1.7. Exploitation allows attackers to extract arbitrary database information through boolean- or time-based inference techniques without authentication or user interaction. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity, with a network attack vector, no privileges required, and no user interaction needed. The vulnerability impacts confidentiality significantly but does not affect integrity or availability. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive database information including customer records, order data, and stored credentials or tokens. This compromises the confidentiality of the affected Joomla storefront's data. The vulnerability does not require authentication or user interaction, increasing the risk of exploitation. There is no indication of impact on data integrity or service availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the storefront product list and product-tags filter endpoints or applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting these parameters. Monitor vendor communications for updates on patches or official mitigations.