CVE-2026-77999 - Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6
Brief
CVE ID : CVE-2026-77999
Published : Sept. 3, 2026, 11:58 a. m.
- 25 minutes ago
Description : Joomla Extension - j2commerce. com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.
- 0-3.
- 21, 4.
- 0-4.
- 21, 4.
- 0-4.
- 6 - The PayPal IPN listener's signature check (`_validateIPN()`) accepted `UNVERIFIED` and any non-`INVALID` response as valid, made its verification request with `CURLOPT_SSL_VERIFYPEER` disabled, and stored its verdict in a field nothing downstream ever checked — so processing continued regardless of the outcome.
Separately, the paid-amount comparison only ran when `mc_gross` was a positive number; omitting the field from the POST body (`floatval(null) == 0`) skipped the check entirely.