CVE-2026-82189 is an external control of an assumed-immutable web parameter vulnerability (CWE-472) in the J2Store extension for Joomla. It allows unauthenticated attackers to mark any order as Failed without providing correct payment or transaction data. This can be exploited to perform denial-of-service attacks on the order pipeline by mass-failing pending orders or flipping fulfilled orders back to Failed, disrupting business operations and customer support processes. The vulnerability affects multiple version ranges of J2Store and does not require authentication or valid transaction details to exploit.

The vulnerability enables unauthenticated attackers to disrupt the order processing workflow by marking orders as Failed. This can lead to denial-of-service conditions against the order pipeline, revenue disruption due to mass-failing of pending orders, and operational confusion from flipping fulfilled orders back to Failed. The latter may cause unwarranted refunds, cancellations, and increased customer support load. No authentication or valid payment data is required, increasing the attack surface and ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, monitor for unusual order status changes and consider implementing additional access controls or validation on order status updates to mitigate unauthorized modifications.