J2Commerce Plugin Update rollback to vulnerable version

Jurahausverein e.V. · 2026-09-26T15:10:53+00:00

Hallo Zusammen, seit ein paar Wochen wird trotz aktuellster Updates der J2Commerce-Erweiterung auf zunächst Version 4.1.7 und mittlerweile 4.1.10 angezeigt, dass diese Erweiterung verwundbar ist. Bei Auto-Update von 4.1.7 auf 4.1.10 hat HTProtect sogar einen Rollback auf die als vulnerabel gemeldete Version 4.0.5 gemacht. Wie kann diese Fehlermeldung beseitigt werden, so dass die automatischen Updates für diese Erweiterung wieder vollständig funktionieren? Im Dashboard wird noch Version 4.0.5 als installiert angezeigt, im Plugin selbst jedoch die zuletzt aktualsierte (siehe Screenshot). Danke für die Hilfe und für diese ansonsten extrem hilfreiche Erweiterung HTProtect! Viele Grüße Agnes

Jurahausverein e.V.

Hello everyone,
For a few weeks now, despite having the latest updates of the J2Commerce extension—initially version 4.1.7 and now 4.1.10—it's still showing that this extension is vulnerable. When auto-updating from 4.1.7 to 4.1.10, HTProtect even rolled back to the version 4.0.5, which was reported as vulnerable.

How can I get rid of this error message so that automatic updates for this extension work properly again? The dashboard still shows version 4.0.5 as installed, but the plugin itself shows the latest update (see screenshot).

Thanks for the help and for this otherwise super useful HTProtect extension!

Best regards
Agnes

Pascal

Hi Agnes,

thanks for the detailed description. HTProtect reads the installed version from the
component’s manifest, and it looks like yours says 4.0.5 there. That’s why you’re getting the warning, the
wrong display in the dashboard — and the rollback, because HTProtect treated an
auto-update without a version number increase as a failure. This will be handled differently from version 2.7.17.

Two quick requests, in this order:

1) Before you change anything, please take a quick look at these two files — a
reinstallation overwrites them, and then the trail is gone:
administrator/components/com_j2store/j2store.xml -> line with
administrator/components/com_j2store/version.php -> line with J2STORE_VERSION
(J2Store keeps two version numbers side by side: its own dashboard
shows the second one, Joomla and HTProtect read the first.)

2) Then manually install J2Store (the current 4.1.10) over the existing
installation once — this will rewrite the registration.

Let me know how it goes with the next J2Store update (if any more vulnerabilities pop up).

Alternatively, you could set J2Store’s auto-update option to “Never” in the extension list. That’s often a good idea for mission-critical shop extensions, so you can run proper tests before and after an update.

J2Store is now part of my test sites too — I’m about to simulate an
auto-update to make sure everything runs smoothly with the next HTProtect version when doing an auto (security) update.

Cheers,

Pascal

Quick update: I've now tested the update from 4.1.7 to 4.1.10 on my test site using the auto-update. It went through smoothly – the bundled plugins were updated correctly too, and the version number showed 4.1.10 everywhere afterwards. So after your manual install, everything should line up perfectly again.

Jurahausverein e.V.

Hi Pascal,
thanks for getting back to me. As you suggested, I first checked the two files: both versions were already identical at 4.1.10 before I reinstalled.
After reinstalling (fresh download of the install file from the vendor), nothing changed there, but the files were definitely rewritten — at least the file creation date on the webspace was updated.
However, the version shown in the HTProtect dashboard still says 4.0.5. To avoid another rollback with the next J2Store update, I’ve left the auto-update disabled for now. I’ll keep you posted on how it behaves with the next version.

Best regards
Agnes