Vulnerabilities

The Address Delete controller in Mageplaza's GDPR extension for Magento 2 (mageplaza/module-gdpr) through version 4.2.9 lacks an authorization check: it extends Magento's legacy Action class rather than AbstractAccount, so requests are not required to be authenticated, to belong to the address owner, or to carry a valid form key. An unauthenticated remote attacker can delete any customer's saved address by sending a GET request to /customer/address/delete/id/{id} with an arbitrary address ID. By iterating address IDs, the attacker can erase every stored customer address on the affected store; the impact is to data integrity only (CVSS C:N/I:H/A:N), with no data exposure or code execution. Any Magento 2 store running the affected Mageplaza GDPR module is exposed, with impact concentrated in loss of saved customer address records rather than site takeover. No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is currently known.

Do: Check the installed mageplaza/module-gdpr version and upgrade to a release newer than 4.2.9 as soon as Mageplaza publishes a patched version. As an interim mitigation, block or require authentication for GET requests to /customer/address/delete/id/ at the web server or WAF level, and review access logs for unauthenticated hits to that endpoint to detect any address deletion already performed.

CVE-2026-79323 is an information disclosure flaw (CWE-200) in the blogComments GraphQL query of the Magefan Blog GraphQL extension (magefan/module-blog-graph-ql) for Magento 2. A remote, unauthenticated attacker can send a POST request to the store's /graphql endpoint invoking the blogComments query, which returns more data than it should. The attacker gains blog commenters' email addresses along with internal customer and admin account identifiers, with no privileges or user interaction required (CVSS 3.1: 7.5, high confidentiality impact). Any Magento 2 store running this module in version 2.2.1 or earlier is affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known as of publication.

Do: Update magefan/module-blog-graph-ql to the first patched release after 2.2.1 (check Magefan's changelog) and deploy it with a standard composer update and cache flush. As an interim mitigation, restrict or disable unauthenticated access to the blogComments GraphQL query (e.g., via GraphQL introspection/field controls or edge rules) so commenter email addresses are not returned. Review web logs for unauthenticated POSTs to /graphql invoking blogComments and consider notifying commenters whose email addresses may have been exposed.

CVE-2026-79322 is an unauthenticated SQL injection (CWE-89) in the RelatedProduct block of Mageplaza Blog for Magento 2, affecting all versions through 4.3.2. A remote attacker can trigger it by sending a crafted id parameter to the /mpblog/post/view route, with no authentication or user interaction required. Successful exploitation permits execution of arbitrary SQL commands and reading of arbitrary database contents, which typically includes sensitive Magento data such as customer records, orders, and admin credentials, with limited additional integrity and availability impact per the CVSS vector. Any Magento 2 store running the Mageplaza Blog extension at version 4.3.2 or older, with blog routes reachable by unauthenticated visitors, is affected. The flaw is not currently in CISA's KEV, and no public proof-of-concept or confirmed in-the-wild exploitation is known.

Do: Upgrade the Mageplaza Blog extension to the latest release, i.e., any version newer than 4.3.2, or apply the vendor patch when available. Until patched, mitigate by blocking or strictly validating the id parameter on /mpblog/post/view at the web application firewall, or by disabling the extension's blog routes. Review web and database logs for anomalous SQL activity tied to the blog route to check for prior exploitation.