CVE-2026-67362
MediumPublished
Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
- Published
- Aug 21, 2026
- Updated
- Aug 21, 2026
- Assigning CNA
- Joomla
- Evidence observed
- Aug 24, 2026
Primary CVSS
5.1/ 10Medium
cvelist · CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:NSummary
Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the shop's trusted domain. No authentication required.
Sources
PoC for J2Store CVE-2026-67358–67362 (J2Commerce security advisory Aug 2026)
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.