CyberRota Analysis
AI-GeneratedThe Mageplaza GDPR module for Magento 2 is vulnerable due to a lack of authorization in the Address Delete controller, allowing remote unauthenticated attackers to delete any customer's saved addresses through a simple GET request. This vulnerability poses a significant risk of data loss and privacy violations, making it critical for e-commerce platforms using this module to prioritize immediate remediation. Organizations utilizing this module should implement security measures to prevent unauthorized access and address this vulnerability promptly.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 (mageplaza/module-gdpr) through 4.2.9 allows remote unauthenticated attackers to delete any customer's saved address, and to erase all stored addresses by iterating the address id, via a GET request to /customer/address/delete/id/{id}. The controller extends the legacy Action class instead of AbstractAccount, so no authentication, ownership or form key check is enforced.
Related CVEs
Other vulnerabilities affecting the same vendor(s)