PT-2026-79434 · WordPress · J2Store
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
J2Store versions 1.0.0 through 3.3.20
J2Store versions 4.0.0 through 4.0.20
J2Store versions 4.1.0 through 4.1.5
Description
An unauthenticated visitor can access the full checkout confirmation page of an order, exposing sensitive data such as line items, prices, and totals. This occurs when a user provides an arbitrary
order id as a query parameter.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
J2Store