CVE-2026-79324CWE-639CWE-862broken-access-control

CVE-2026-79324

High · published September 10, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
46.1
In the wild
Unconfirmed
What it is

Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 (mageplaza/module-gdpr) through 4.2.9 allows remote unauthenticated attackers to delete any customer's saved address, and to erase all stored addresses by iterating the address id, via a GET request to /customer/address/delete/id/{id}. The controller extends the legacy Action class instead of AbstractAccount, so no authentication, ownership or form key check is enforced.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00564 · 46.1th percentile
Weaknesses
CWE-639 · Authorization Bypass Through User-Controlled Key; CWE-862 · Missing Authorization
Published
2026-09-10T00:20Z
Affected products (1)
ProductVersionsFixed in
mageplaza/gdpr≤ 4.2.9—
References (2)
https://gist.github.com/mrtantoine/4311aa0c267c7a77c15d292820eb3c36 · [email protected]https://packagist.org/packages/mageplaza/module-gdpr · [email protected]
EPSS history
Timeline
  • 11 SEP 03:19Z
    EPSS moved — → 0%
    epss
  • 09 SEP 00:00Z
    Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 (mageplaza/module-gdpr) through 4.2.9 allows remote unauthenticated…
    cvelistv5