CVE-2026-77999

Name of the Vulnerable Software and Affected Versions J2Store versions 1.0.0 through 3.3.21 J2Store versions 4.0.0 through 4.0.21 J2Store versions 4.1.0 through 4.1.6

Description An unauthenticated PayPal callback forgery allows for order confirmation fraud. The PayPal IPN listener's signature check function validateIPN() incorrectly accepts UNVERIFIED and any response that is not INVALID as valid. Additionally, the verification request is made with CURLOPT SSL VERIFYPEER disabled, and the resulting verdict is stored in a field that is not checked by downstream processes, allowing processing to continue regardless of the outcome. Furthermore, the paid-amount comparison only occurs when the mc gross variable is a positive number; omitting this field from the POST body skips the check entirely. By using a merchant-configured receiver email and a sequential, enumerable order ID from the custom field, an anonymous POST request can move a pending order to CONFIRMED without payment or change another customer's pending order to FAILED. The paypalv2.php file performs no amount check under any circumstances.

Recommendations Update J2Store to a version newer than 3.3.21. Update J2Store to a version newer than 4.0.21. Update J2Store to a version newer than 4.1.6.