CVE-2026-79324: Mageplaza GDPR Authorization Bypass Vulnerability

CVE-2026-79324 Overview

CVE-2026-79324 is a missing authorization vulnerability in the Address Delete controller of the Mageplaza GDPR module for Magento 2 (mageplaza/module-gdpr) through version 4.2.9. The controller extends the legacy Action class instead of AbstractAccount, bypassing authentication, ownership, and form key validation. Remote unauthenticated attackers can delete any customer's saved address by issuing a GET request to /customer/address/delete/id/{id}. By iterating address identifiers, an attacker can erase every stored address across the store.

Critical Impact

Unauthenticated attackers can mass-delete customer address records, causing integrity loss across the Magento storefront and disrupting checkout, shipping, and GDPR compliance workflows.

Affected Products

• Mageplaza GDPR for Magento 2 (mageplaza/module-gdpr) versions through 4.2.9
• Magento 2 storefronts with the Mageplaza GDPR extension installed
• Composer deployments sourcing the module from Packagist

Discovery Timeline

• 2026-09-09 - CVE-2026-79324 published to the National Vulnerability Database (NVD)
• 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-79324

Vulnerability Analysis

The Mageplaza GDPR module exposes an Address Delete controller intended to support the right-to-erasure workflow for customer address records. The controller implements the delete action by extending Magento's legacy \Magento\Framework\App\Action\Action base class. That base class does not enforce customer session validation, ownership checks against the address entity, or form key verification. As a result, the endpoint at /customer/address/delete/id/{id} accepts anonymous requests and treats the numeric id path segment as a trusted reference to any address row in the database.

The issue is categorized under [CWE-639: Authorization Bypass Through User-Controlled Key]. Because the address identifier is a sequential integer, an attacker can enumerate the entire address space and issue delete requests in bulk. The action is destructive and non-recoverable without database restoration.

Root Cause

The root cause is an incorrect controller base class. Customer-scoped controllers in Magento 2 must extend \Magento\Customer\Controller\AbstractAccount, which registers the request under the customer handler and enforces authenticated session context along with CSRF protection. Extending the generic Action class removes those guarantees while leaving the destructive operation intact.

Attack Vector

Exploitation requires only network access to the storefront. An attacker sends an HTTP GET request to /customer/address/delete/id/{id}, substituting incrementing integer values for {id}. No session cookie, authentication header, or form key parameter is required. The controller resolves the address by ID and deletes it without validating that the requester owns the record. Automation with a simple loop over the address identifier range enables complete erasure of stored customer addresses. See the published GitHub Gist proof of concept for request details.

Detection Methods for CVE-2026-79324

Indicators of Compromise

• Sequential GET requests to /customer/address/delete/id/{id} from a single source IP within a short time window
• Requests to the address delete endpoint that lack a valid PHPSESSID cookie or form_key parameter
• Sudden drop in row count of the customer_address_entity table without corresponding admin activity
• Customer support tickets reporting missing saved shipping or billing addresses

Detection Strategies

• Parse Nginx or Apache access logs for GET requests targeting /customer/address/delete/ and flag unauthenticated sources
• Alert on high-frequency access to the delete endpoint that returns HTTP 200 or 302 without a preceding authenticated session
• Compare address deletion events in the Magento application log against authenticated customer session events

Monitoring Recommendations

• Enable web application firewall (WAF) logging in front of the Magento storefront and retain full URI paths
• Monitor database write operations on customer_address_entity and alert on bulk DELETE patterns
• Track HTTP referrer and user-agent anomalies on customer account endpoints

How to Mitigate CVE-2026-79324

Immediate Actions Required

• Restrict access to /customer/address/delete/ at the WAF or reverse proxy layer until a patched module is deployed
• Require an authenticated session cookie for any request to customer address controllers
• Take a fresh backup of the customer_address_entity table so deleted records can be recovered
• Audit recent access logs for exploitation attempts using the request pattern described above

Patch Information

At the time of publication, no vendor advisory URL is listed in the NVD entry. Administrators should monitor the Mageplaza GDPR module on Packagist for a release above version 4.2.9 that changes the Address Delete controller to extend \Magento\Customer\Controller\AbstractAccount and enforces ownership validation and form key verification.

Workarounds

• Disable the Mageplaza GDPR module using bin/magento module:disable Mageplaza_Gdpr if the erasure workflow is not in active use
• Add a WAF rule that blocks unauthenticated requests to any URI matching ^/customer/address/delete/
• Override the vulnerable controller with a local plugin that calls $this->_customerSession->authenticate() and validates that the address belongs to the current customer before delegating to the original action

# Example Nginx block for the vulnerable endpoint until patching
location ~ ^/customer/address/delete/ {
    if ($cookie_PHPSESSID = "") {
        return 403;
    }
}