Gdpr
Monthly
Unauthenticated address deletion in Mageplaza GDPR for Magento 2 (versions through 4.2.9) allows any remote attacker to destroy saved customer addresses across an entire store via sequential GET requests. The Address Delete controller inherits from Magento 2's legacy base `Action` class rather than `AbstractAccount`, meaning no session authentication, address ownership check, or CSRF form-key validation is applied. A public proof-of-concept gist exists; no actively exploited (CISA KEV) status has been confirmed, but the trivial iteration attack vector makes this readily weaponizable against any merchant running the affected module.
Unauthenticated address deletion in Mageplaza GDPR for Magento 2 (versions through 4.2.9) allows any remote attacker to destroy saved customer addresses across an entire store via sequential GET requests. The Address Delete controller inherits from Magento 2's legacy base `Action` class rather than `AbstractAccount`, meaning no session authentication, address ownership check, or CSRF form-key validation is applied. A public proof-of-concept gist exists; no actively exploited (CISA KEV) status has been confirmed, but the trivial iteration attack vector makes this readily weaponizable against any merchant running the affected module.