CVE-2026-79322: SQL Injection

Q: Who can exploit this issue?

Any remote, unauthenticated attacker can target the affected endpoint. No authentication is required according to the available data.

Q: What request input is involved in exploitation?

The vulnerable input is the id parameter sent to /mpblog/post/view. Exploitation can allow arbitrary SQL commands and reading arbitrary database contents.

Q: Which installations should be considered affected?

Mageplaza Blog for Magento 2, package mageplaza/magento-2-blog-extension, is affected through version 4.3.2. The provided data does not identify any configuration prerequisite or mitigation.

Published Sep 9, 2026

Updated

SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 (mageplaza/magento-2-blog-extension) through 4.3.2 allows remote unauthenticated attackers to execute arbitrary SQL commands and read arbitrary database contents via the id parameter to /mpblog/post/view.

Affected Software

1 affected component

mageplaza/magento-2-blog-extension<=4.3.2

Event History

Sep 9, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any remote, unauthenticated attacker can target the affected endpoint. No authentication is required according to the available data.

What request input is involved in exploitation?

The vulnerable input is the id parameter sent to /mpblog/post/view. Exploitation can allow arbitrary SQL commands and reading arbitrary database contents.

Which installations should be considered affected?

Mageplaza Blog for Magento 2, package mageplaza/magento-2-blog-extension, is affected through version 4.3.2. The provided data does not identify any configuration prerequisite or mitigation.