CVE-2026-77999 j2commerce.com CVE debrief

Who should care

Organizations using J2Store versions 1.0.0-3.3.21, 4.0.0-4.0.21, and 4.1.0-4.1.6 should be aware of the potential for order confirmation fraud and take steps to mitigate the vulnerability. This includes reviewing and applying patches, verifying PayPal IPN listener configuration, and implementing additional monitoring for suspicious order activity. Affected operators and platforms should prioritize patching to prevent potential order confirmation fraud. Vulnerability management and security teams should also be aware of the vulnerability and its potential impact.

Technical summary

The PayPal IPN listener's signature check (_validateIPN()) accepted 'UNVERIFIED' and any non-'INVALID' response as valid, made its verification request with CURLOPT_SSL_VERIFYPEER disabled, and stored its verdict in a field nothing downstream ever checked — so processing continued regardless of the outcome. Separately, the paid-amount comparison only ran when 'mc_gross' was a positive number; omitting the field from the POST body (floatval(null) == 0) skipped the check entirely. Combined with a merchant-configured 'receiver_email' and a sequential, enumerable order id read from the 'custom' field, an anonymous POST was enough to move a pending order straight to 'CONFIRMED' with no payment, or force another customer's pending order to 'FAILED'. 'paypalv2.php' performed no amount check under any circumstances. The vulnerability affects J2Store versions 1.0.0-3.3.21, 4.0.0-4.0.21, and 4.1.0-4.1.6.

Defensive priority

Organizations using J2Store versions 1.0.0-3.3.21, 4.0.0-4.0.21, and 4.1.0-4.1.6 should prioritize patching to prevent potential order confirmation fraud.

Recommended defensive actions

• Review and apply patches for J2Store versions 1.0.0-3.3.21, 4.0.0-4.0.21, and 4.1.0-4.1.6
• Verify PayPal IPN listener configuration and validate signature checks
• Implement additional monitoring for suspicious order activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record indicates that the PayPal IPN listener's signature check accepted 'UNVERIFIED' and any non-'INVALID' response as valid. Verification requests were made with CURLOPT_SSL_VERIFYPEER disabled, and the verdict was stored in a field that downstream processes never checked. This, combined with a flawed paid-amount comparison, allowed for order confirmation fraud.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.