Mageplaza vulnerabilities
Published CVEs affecting Mageplaza products: 3 record(s), with severity, exploitation and fixes.
CVE-2026-79324
High · 7.5
CWE-639 Sep 9, 2026
Authorization Bypass Through User-Controlled Key (IDOR) in Mageplaza Gdpr
Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 (mageplaza/module-gdpr) through 4.2.9 allows remote unauthenticated attackers to delete any customer's saved address, and to erase all stored addresses by iterating the address id, via a GET request to /customer/address/delete/id/{id}. The controller extends the legacy Action class instead of AbstractAccount, so no authentication, ownership or form key check is enforced.
CVE-2026-79323
High · 7.5
CWE-200 Sep 9, 2026
Exposure of Sensitive Information in Mageplaza Magefan Blog
Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 (magefan/module-blog-graph-ql) through 2.2.1 allows remote unauthenticated attackers to obtain blog commenter email addresses and internal customer and admin identifiers via a POST request to /graphql.
CVE-2026-79322
High · 8.6
CWE-89 Sep 9, 2026
SQL Injection in Mageplaza Mageplaza Blog
SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 (mageplaza/magento-2-blog-extension) through 4.3.2 allows remote unauthenticated attackers to execute arbitrary SQL commands and read arbitrary database contents via the id parameter to /mpblog/post/view.