| Package | Affected versions | Patched versions |
|---|---|---|
| gdpr | ≤ 4.2.9 |
Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 (mageplaza/module-gdpr) through 4.2.9 allows remote unauthenticated attackers to delete any customer's saved address, and to erase all stored addresses by iterating the address id, via a GET request to /customer/address/delete/id/{id}. The controller extends the legacy Action class instead of AbstractAccount, so no authentication, ownership or form key check is enforced.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free