Mageplaza vulnerabilities
We track 3 vulnerabilities in Mageplaza products across 3 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 9, 2026.
Latest Mageplaza vulnerabilities
- 7.5 High severity
Gdpr: Authorization Bypass Through User-Controlled Key
Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 (mageplaza/module-gdpr) through 4.2.9 allows remote unauthenticated attackers to delete any customer's saved address, and to erase all stored addresses by iterating the addr
- 7.5 High severity
Magefan Blog: Exposure of Sensitive Information to an Unauthorized Actor
Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 (magefan/module-blog-graph-ql) through 2.2.1 allows remote unauthenticated attackers to obtain blog commenter email addresses and internal customer and admin identif
- 8.6 High severity
Mageplaza Blog: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 (mageplaza/magento-2-blog-extension) through 4.3.2 allows remote unauthenticated attackers to execute arbitrary SQL commands and read arbitrary database contents via the id parameter to