{"vulnerability": "CVE-2026-7932", "sightings": [{"uuid": "71183f9e-9c99-48b8-bf77-404007f4af4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-7932", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities_20260507", "content": "", "creation_timestamp": "2026-05-06T18:00:00.000000Z"}, {"uuid": "fab5ba7d-9378-480b-8211-ac7f39585936", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-7932", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities_20260508", "content": "", "creation_timestamp": "2026-05-07T18:00:00.000000Z"}, {"uuid": "5e712629-3953-49c2-8148-cfc1a2dd2306", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79324", "type": "seen", "source": "https://gist.github.com/mrtantoine/4311aa0c267c7a77c15d292820eb3c36", "content": "# CVE-2026-79324 \u2014 Unauthenticated Deletion of Any Customer Address in Mageplaza GDPR for Magento 2 through 4.2.9\n\n## Summary\n\nMissing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 (mageplaza/module-gdpr) through 4.2.9 allows remote unauthenticated attackers to delete any customer's saved address, and to erase all stored addresses by iterating the address id, via a GET request to /customer/address/delete/id/{id}. The controller extends the legacy Action class instead of AbstractAccount, so no authentication, ownership or form key check is enforced.\n\n## Affected\n\n- Product: Mageplaza GDPR for Magento 2 (mageplaza/module-gdpr)\n- Versions: through 4.2.9 (current latest release, published 2026-07-13; no fixed version available)\n- Authentication required: none (unauthenticated)\n\n## Details\n\nThe module registers etc/frontend/routes.xml with , so Mageplaza\\Gdpr\\Controller\\Address\\Delete handles /customer/address/delete/id/{id} instead of the Magento core controller.\n\nThe controller extends Magento\\Framework\\App\\Action\\Action (line 37), not AbstractAccount, so the customer login plugin bound to AbstractAccount never runs. execute() reads the id from the request (line 71) and calls $this->_addressRepository->deleteById($addressId) (line 74) with no isLoggedIn check, no ownership verification and no form key.\n\nThe constructor injects neither the customer session nor an authorization helper. execute() never calls isLoggedIn(), never reads the session customer id, and never verifies that the address belongs to the caller. Because the class extends the legacy Action, the Magento\\Customer\\Controller\\Plugin\\Account login gate does not apply, and a GET requires no form key.\n\nThe same module ships the correctly protected sibling Controller/Account/Delete.php, which extends AbstractAccount and checks isLoggedIn() (line 123), which shows the missing gate on the address controller is an oversight rather than intended behaviour.\n\nVerified on a local Mage-OS lab running Mageplaza GDPR 4.2.9 (latest). A saved address (entity_id 6, owned by customer 1) was deleted by an unauthenticated GET to /customer/address/delete/id/6 (HTTP 302 to /customer/address/, processed), while an anonymous GET to /customer/address/ returns HTTP 302 to the login page. After the request, SELECT COUNT(*) FROM customer_address_entity WHERE entity_id = 6 returns 0.\n\n## Attack vector\n\nSingle unauthenticated HTTP GET to /customer/address/delete/id/{id} where {id} is an attacker-chosen address entity id. No account, cookie, form key or user interaction required. Iterating the numeric id deletes every saved customer address in the store.\n\n## Impact\n\nAn unauthenticated attacker deletes any customer's stored address, and by iterating id 1..N erases every saved address in the store. This is a store-wide integrity and data-loss issue affecting customer PII and degrading checkout for the affected customers. No account, cookie, form key or user interaction is required. On a module whose purpose is GDPR data handling, the endpoint that should be the most access-controlled is the least.\n\n## CVSS 3.1\n\nAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N = 7.5 (High)\n\n## Remediation\n\nGate the controller like its sibling: extend Magento\\Customer\\Controller\\AbstractAccount, verify $this->customerSession->isLoggedIn(), and confirm the target address belongs to the session customer ($address->getCustomerId() === $this->customerSession->getCustomerId()) before calling deleteById. Require a valid form key and use POST for the state change.\n\n## References\n\n- https://packagist.org/packages/mageplaza/module-gdpr\n- https://www.mageplaza.com/magento-2-gdpr/\n- CWE-862 Missing Authorization\n- CWE-639 Authorization Bypass Through User-Controlled Key (IDOR)\n\n## Credit\n\nDiscovered by Antoine Morato.", "creation_timestamp": "2026-09-08T21:28:11.446683Z"}, {"uuid": "7ea7e879-702d-458e-82e2-840e3ac4bb9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79323", "type": "seen", "source": "https://gist.github.com/mrtantoine/4331a5f04f8309eb1799b257a7371f34", "content": "# CVE-2026-79323 \u2014 Information Disclosure in Magefan Blog GraphQL for Magento 2 through 2.2.1\n\n## Summary\n\nInformation disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 (magefan/module-blog-graph-ql) through 2.2.1 allows remote unauthenticated attackers to obtain blog commenter email addresses and internal customer and admin identifiers via a POST request to /graphql.\n\n## Affected\n\n- Product: Magefan Blog GraphQL for Magento 2 (magefan/module-blog-graph-ql)\n- Versions: through 2.2.1 (current latest release, published 2026-06-24; no fixed version available). Requires magefan/module-blog, tested with 2.13.1 (latest).\n- Authentication required: none (unauthenticated)\n\n## Details\n\nThe blogComments query is declared as a top-level Query field in etc/schema.graphqls with a resolver and no access directive. Model/Resolver/Comments.php builds its search criteria from only two constraints, status and the caller-supplied post_id, with no per-user scoping and no field allowlist, so raw comment rows including author_email are serialized to any anonymous caller.\n\nVerified on a local Mage-OS lab with Magefan Blog 2.13.1 and Blog GraphQL 2.2.1 (both latest). Unauthenticated response:\n\n{\"data\":{\"blogComments\":{\"items\":[{\"comment_id\":1,\"author_nickname\":\"VictimNick\",\"author_email\":\"victim-SECRET-email@private.example\",\"customer_id\":0,\"admin_id\":0}]}}}\n\nThe email is not otherwise public: the shipped comment display template view/frontend/templates/post/view/comments/magefan/comment.phtml renders only the nickname, the publish date and the comment text. author_email appears only as a submit-form input name in magefan.phtml. This control is a static verification of the shipped templates; the blog front-end route was not enabled on the test instance.\n\n## Attack vector\n\nSingle unauthenticated HTTP POST to /graphql with a blogComments query requesting the author_email field. No Authorization header, no cookie, no session, no user interaction. Iterating post_id harvests every approved commenter email on the site.\n\n## Impact\n\nAn unauthenticated attacker can enumerate blog posts and harvest the email addresses of every commenter, along with the internal customer_id and admin_id that tie a comment to a registered customer or an admin user. Under GDPR these are personal data.\n\n## CVSS 3.1\n\nAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3 (Medium)\n\n## Remediation\n\nDo not expose author_email, customer_id and admin_id on the anonymous blogComments query. Either remove these fields from the public BlogComment GraphQL type, or gate them behind an authenticated and authorized resolver, or strip them in the data provider before returning results to unauthenticated callers.\n\n## References\n\n- https://magefan.com/magento2-blog-extension\n- CWE-862 Missing Authorization\n- CWE-639 Authorization Bypass Through User-Controlled Key\n\n## Credit\n\nDiscovered by Antoine Morato.", "creation_timestamp": "2026-09-08T21:28:11.522958Z"}, {"uuid": "35c4448a-74a1-42ea-b077-f0d08a9b47ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79322", "type": "seen", "source": "https://gist.github.com/mrtantoine/417ee9b774f022bd747211b9eadc0069", "content": "# CVE-2026-79322 \u2014 SQL Injection in Mageplaza Blog for Magento 2 through 4.3.2\n\n## Summary\n\nSQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 (mageplaza/magento-2-blog-extension) through 4.3.2 allows remote unauthenticated attackers to execute arbitrary SQL commands and read arbitrary database contents via the id parameter to /mpblog/post/view.\n\n## Affected\n\n- Product: Mageplaza Blog for Magento 2 (mageplaza/magento-2-blog-extension)\n- Versions: through 4.3.2 (current latest release, published 2026-07-02; no fixed version available)\n- Authentication required: none (unauthenticated)\n\n## Details\n\nBlock/Post/RelatedProduct.php line 150 reads the id query parameter ($postId = $this->getRequest()->getParam('id')) and line 160 concatenates it directly into a Zend_Db_Select where() clause: ->where('product_post.post_id = ' . $postId), without cast, quoting or binding. Vulnerable code at commit d3b0cdfbe6635bd0a15cb2acde165d00660ccb0b (tag v4.3.2).\n\nVerified on a local Mage-OS lab running Mageplaza Blog 4.3.2 (latest). Server-side confirmation from MySQL general query log shows the injected payload reaches the database verbatim:\n\nWHERE (product_post.post_id = 1 AND SLEEP(5))\n\nIn the same request, the post-load query correctly binds the same input (WHERE 'mageplaza_blog_post'.'post_id'='1 AND SLEEP(5)'), which shows the RelatedProduct block is an oversight rather than intentional behaviour.\n\nTime-based proof, warm URLs, 3 passes:\n- pass1: SLEEP(0)=0.29s, SLEEP(5)=5.31s\n- pass2: SLEEP(0)=0.28s, SLEEP(5)=5.33s\n- pass3: SLEEP(0)=0.33s, SLEEP(5)=5.24s\n\nPrecondition: the target post must have at least one related product configured.\n\n## Attack vector\n\nUnauthenticated HTTP GET. An attacker appends SQL to the id parameter of /mpblog/post/view (e.g. id=1 AND SLEEP(5)); the value is concatenated raw into the related-products WHERE clause and executed by the database. No user interaction required.\n\n## Impact\n\nAn unauthenticated remote attacker can execute arbitrary SQL queries, read the full database contents (customer data, admin credentials, orders), and cause denial of service.\n\n## CVSS 3.1\n\nAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L = 8.6 (High)\n\n## Remediation\n\nUse parameter binding instead of string concatenation in _getProductCollection(): replace ->where('product_post.post_id = ' . $postId) with ->where('product_post.post_id = ?', (int) $postId).\n\n## References\n\n- https://github.com/mageplaza/magento-2-blog/tree/v4.3.2\n- https://www.mageplaza.com/magento-2-blog-extension/\n- CWE-89 SQL Injection\n\n## Credit\n\nDiscovered by Antoine Morato.", "creation_timestamp": "2026-09-08T21:28:13.902473Z"}, {"uuid": "3c6d1b8e-d575-43d1-a767-1c1ba50b7944", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79322", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/d7ln6a7y6dk2m", "content": "CVE-2026-79322 - Mageplaza Blog for Magento SQL Injection\nCVE ID : CVE-2026-79322\n \n Published : Sept. 9, 2026, 7:17 p.m. | 18\u00a0minutes ago\n \n Description : SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 (mageplaza/magento-2-blog-extension) through 4....", "creation_timestamp": "2026-09-09T19:58:51.028593Z"}, {"uuid": "284142ef-5ed5-4a1e-a4b9-a6ebb2dfb2de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79323", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/itlffggmuxgud", "content": "CVE-2026-79323 - Magefan Blog GraphQL Information Disclosure\nCVE ID : CVE-2026-79323\n \n Published : Sept. 9, 2026, 7:17 p.m. | 18\u00a0minutes ago\n \n Description : Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 (magefan/module-blog-gr...", "creation_timestamp": "2026-09-09T20:00:52.910304Z"}, {"uuid": "e7f69f55-532c-4132-81bf-411a621b93f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79324", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mv4gnst4o42s", "content": "\ud83d\udfe0 CVE-2026-79324 - High (7.5)\n\nMissing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 (mageplaza...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-79324/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-09T21:01:28.081519Z"}, {"uuid": "ef3fc84d-c225-48f1-a6f3-556053277246", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79322", "type": "seen", "source": "https://bsky.app/profile/experiencedigest.bsky.social/post/3mv4v6nxm3l2k", "content": "CVE-2026-79322 (HIGH) CVSS 8.6: https://experiencedigest.org/2026/09/09/212042.html", "creation_timestamp": "2026-09-10T01:21:24.912902Z"}, {"uuid": "f623673d-fdef-4491-a292-ea2c9a4cd870", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79323", "type": "seen", "source": "https://bsky.app/profile/experiencedigest.bsky.social/post/3mv4v6okvda2g", "content": "CVE-2026-79323 (HIGH) CVSS 7.5: https://experiencedigest.org/2026/09/09/fed762.html", "creation_timestamp": "2026-09-10T01:21:25.517338Z"}, {"uuid": "66836c5b-c93f-4ddd-ad40-24c1e0fda6f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79324", "type": "seen", "source": "https://bsky.app/profile/experiencedigest.bsky.social/post/3mv4vc65n6b2c", "content": "CVE-2026-79324 (HIGH) CVSS 7.5: https://experiencedigest.org/2026/09/09/212232.html", "creation_timestamp": "2026-09-10T01:23:22.358722Z"}, {"uuid": "e5b7c8fa-4a34-47e2-b07e-b933ad6fd562", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79322", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mvduzgh6qb25", "content": "\ud83d\udccc CVE-2026-79322 - SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 (mageplaza/magento-2-blog-extension) through 4.3.2 allows remote unauthentic... https://www.cyberhub.blog/cves/CVE-2026-79322", "creation_timestamp": "2026-09-12T20:07:07.283597Z"}]}