Vulnerabilities

The Address Delete controller in Mageplaza's GDPR extension for Magento 2 (mageplaza/module-gdpr) through version 4.2.9 lacks an authorization check: it extends Magento's legacy Action class rather than AbstractAccount, so requests are not required to be authenticated, to belong to the address owner, or to carry a valid form key. An unauthenticated remote attacker can delete any customer's saved address by sending a GET request to /customer/address/delete/id/{id} with an arbitrary address ID. By iterating address IDs, the attacker can erase every stored customer address on the affected store; the impact is to data integrity only (CVSS C:N/I:H/A:N), with no data exposure or code execution. Any Magento 2 store running the affected Mageplaza GDPR module is exposed, with impact concentrated in loss of saved customer address records rather than site takeover. No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is currently known.

Do: Check the installed mageplaza/module-gdpr version and upgrade to a release newer than 4.2.9 as soon as Mageplaza publishes a patched version. As an interim mitigation, block or require authentication for GET requests to /customer/address/delete/id/ at the web server or WAF level, and review access logs for unauthenticated hits to that endpoint to detect any address deletion already performed.

CVE-2026-79323 is an information disclosure flaw (CWE-200) in the blogComments GraphQL query of the Magefan Blog GraphQL extension (magefan/module-blog-graph-ql) for Magento 2. A remote, unauthenticated attacker can send a POST request to the store's /graphql endpoint invoking the blogComments query, which returns more data than it should. The attacker gains blog commenters' email addresses along with internal customer and admin account identifiers, with no privileges or user interaction required (CVSS 3.1: 7.5, high confidentiality impact). Any Magento 2 store running this module in version 2.2.1 or earlier is affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known as of publication.

Do: Update magefan/module-blog-graph-ql to the first patched release after 2.2.1 (check Magefan's changelog) and deploy it with a standard composer update and cache flush. As an interim mitigation, restrict or disable unauthenticated access to the blogComments GraphQL query (e.g., via GraphQL introspection/field controls or edge rules) so commenter email addresses are not returned. Review web logs for unauthenticated POSTs to /graphql invoking blogComments and consider notifying commenters whose email addresses may have been exposed.

CVE-2026-79322 is an unauthenticated SQL injection (CWE-89) in the RelatedProduct block of Mageplaza Blog for Magento 2, affecting all versions through 4.3.2. A remote attacker can trigger it by sending a crafted id parameter to the /mpblog/post/view route, with no authentication or user interaction required. Successful exploitation permits execution of arbitrary SQL commands and reading of arbitrary database contents, which typically includes sensitive Magento data such as customer records, orders, and admin credentials, with limited additional integrity and availability impact per the CVSS vector. Any Magento 2 store running the Mageplaza Blog extension at version 4.3.2 or older, with blog routes reachable by unauthenticated visitors, is affected. The flaw is not currently in CISA's KEV, and no public proof-of-concept or confirmed in-the-wild exploitation is known.

Do: Upgrade the Mageplaza Blog extension to the latest release, i.e., any version newer than 4.3.2, or apply the vendor patch when available. Until patched, mitigate by blocking or strictly validating the id parameter on /mpblog/post/view at the web application firewall, or by disabling the extension's blog routes. Review web and database logs for anomalous SQL activity tied to the blog route to check for prior exploitation.

ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service.

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, the BGR decoder does not check for an end-of-file in every location so a crafted image could result in an heap buffer over-read. This issue has been fixed in version 7.1.2-27.

ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line interface when invalid options are provided. Attackers can trigger memory exhaustion by repeatedly supplying malformed command-line arguments to consume system resources.

ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability in the -script operation due to missing security policy checks. This allows reading files from paths that are otherwise disallowed by the configured security policy.

ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution.

ImageMagick before 7.1.2-15 contains a use-after-free vulnerability in the PDB decoder that uses a stale pointer when memory allocation fails. Attackers can trigger this vulnerability by processing malicious PDB files to cause crashes or write a single zero byte to freed memory.

ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the FTXT encoder due to missing boundary checks when parsing ftxt:format. Remote attackers can trigger an out of bounds read by crafting malicious FTXT image files to cause denial of service or information disclosure.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, an integer overflow in the XCF decoder can result in an out of bounds read when a crafted image is read, potentially resulting in a crash. This issue has been fixed in versions 6.9.13-51 and 7.1.2-26.

ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the PasskeyEncipherImage method due to AES-CTR nonce reuse. Attackers can exploit nonce reuse in the cipher implementation to recover plaintext information from encrypted images.

ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that write raw pixel data where allocated objects are not properly freed. Attackers can trigger this leak by processing specially crafted images, causing memory exhaustion and denial of service.

ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering.

ImageMagick before 7.1.2-15 and 6.9.x before 6.9.13-40 contains an integer overflow in the PSB (PSD v2) RLE decoding path (ReadPSDChannelRLE in coders/psd.c) that causes a heap out-of-bounds read on 32-bit builds. Processing a crafted PSB file can lead to information disclosure or a crash.