{"id":"CVE-2026-79324","title":"Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 (mageplaza/module-gdpr) through 4.2.9 allows remote unauthenticated attackers to delete any customer's saved address, and to erase all stored addresse…","summary":"Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 (mageplaza/module-gdpr) through 4.2.9 allows remote unauthenticated attackers to delete any customer's saved address, and to erase all stored addresse…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-639","CWE-862"],"vendor":"mageplaza","product":"gdpr","affected":["gdpr <= 4.2.9"],"published":"2026-09-09","updated":"2026-09-10","sourceUpdated":"2026-09-10T17:48:38.937","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79324","references":[{"url":"https://gist.github.com/mrtantoine/4311aa0c267c7a77c15d292820eb3c36","label":"cve@mitre.org"},{"url":"https://packagist.org/packages/mageplaza/module-gdpr","label":"cve@mitre.org"}],"tags":["nvd","cve.org"],"epss":0.0032,"epssPercentile":0.25165,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-09T19:42:19.932023Z"},"ingestedAt":"2026-09-09T20:21:14.835Z","slug":"CVE-2026-79324","body":"## Overview\n\nMissing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 (mageplaza/module-gdpr) through 4.2.9 allows remote unauthenticated attackers to delete any customer's saved address, and to erase all stored addresses by iterating the address id, via a GET request to /customer/address/delete/id/{id}. The controller extends the legacy Action class instead of AbstractAccount, so no authentication, ownership or form key check is enforced.\n\n## Affected\n\n- `gdpr <= 4.2.9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}