Skip to content
OpenAdvisories
Medium · 6.0 CVE-2026-102803 EUVD-2026-121312GHSA-wrg5-7559-9rj3

Joomla Extension - j2commerce.com - Gift voucher and single-use coupon could pay for more than one order in J2Store 6.0.0 - 6.6.5

Published Nov 10, 2026 · Updated Nov 13, 2026 · Assigned by Joomla

Description

Joomla Extension - j2commerce.com - Gift voucher and single-use coupon could pay for more than one order in J2Store 6.0.0 - 6.6.5 - A logged-in customer could redeem a single gift voucher, or a single-use coupon (`max_uses` / `max_customer_uses` = 1), on more than one order. By starting several checkout sessions and carrying each to the confirm step before submitting any of them, every order independently saw the voucher's full balance or the coupon's unused slot, because the balance/usage calculations and the final placement check both only looked at orders that had already left the "New" state.

Affected products

VendorProductAffectedFixed
j2commerce.com J2Store extension for Joomla 6.0.0-6.6.5 —

References