CVE-2026-79324: Maven/mageplaza/module-gdpr vulnerability
Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 (mageplaza/module-gdpr) through 4.2.9 allows remote unauthenticated attackers to delete any customer's saved address, and to erase all stored addresses by iterating the address id, via a GET request to /customer/address/delete/id/{id}. The controller extends the legacy Action class instead of AbstractAccount, so no authentication, ownership or form key check is enforced.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any remote unauthenticated attacker can exploit it. No customer account, administrative access, address ownership, or form key is required.
What systems and configurations are exposed?
Magento 2 deployments using Mageplaza GDPR (mageplaza/module-gdpr) through version 4.2.9 are affected. The vulnerable address-deletion endpoint is reachable at /customer/address/delete/id/{id}.
What does an attacker need to do?
An attacker only needs to send GET requests containing address IDs. By changing or iterating the ID value, they can delete addresses belonging to other customers and potentially erase all stored customer addresses.
How can I determine whether exploitation may have occurred?
Review web-server, application, and access logs for GET requests to /customer/address/delete/id/{id}, particularly requests from unauthenticated sessions or repeated requests with sequential address IDs. Also investigate unexpected missing saved addresses reported by customers.
What can be done if patching is not immediately possible?
Restrict or block external access to the /customer/address/delete/ path at the web server, proxy, or WAF where operationally feasible. Because the issue is unauthenticated and uses GET requests, monitoring and blocking repeated requests to this endpoint can help reduce exposure.