CVSS 6.0 (medium) · published 2026-11-10
Joomla Extension - j2commerce.com - Gift voucher and single-use coupon could pay for more than one order in J2Store 6.0.0 - 6.6.5 - A logged-in customer could redeem a single gift voucher, or a single-use coupon (`max_uses` / `max_customer_uses` = 1), on more than one order. By starting several checkout sessions and carrying each to the confirm step before submitting any of them, every order independently saw the voucher's full balance or the coupon's unused slot, because the balance/usage calculations and the final placement check both only looked at orders that had already left the "New" state.
Weakness: CWE-367
Source: NVD CVE-2026-102803
Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.