Vulnerabilities & PatchesEmerging1 src
CVE-2026-77999 - Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6
CVE ID : CVE-2026-77999
Published : Sept. 3, 2026, 11:58 a. m.
• 25 minutes ago
Description : Joomla Extension - j2commerce. com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1. 0. 0-3. 3. 21, 4. 0. 0-4. 0. 21, 4. 1. 0-4. 1.
6 - The PayPal IPN listener's signature check (`_validateIPN()`) accepted `UNVERIFIED` and any non-`INVALID` response as valid, made its verification request with `CURLOPT_SSL_VERIFYPEER` disabled, and stored its verdict in a field nothing downstream ever checked — so processing continued regardless of the outcome.
Separately, the paid-amount comparison only ran when `mc_gross` was a positive number; omitting the field from the POST body (`floatval(null) == 0`) skipped the check entirely.
