Description

Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 (mageplaza/module-gdpr) through 4.2.9 allows remote unauthenticated attackers to delete any customer's saved address, and to erase all stored addresses by iterating the address id, via a GET request to /customer/address/delete/id/{id}. The controller extends the legacy Action class instead of AbstractAccount, so no authentication, ownership or form key check is enforced.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-09T20:20:43.040Z",
  "pubdate": "2026-09-09T20:20:43.040Z",
  "executiveSummary": "A critical missing authorization vulnerability exists in the Mageplaza GDPR module for Magento 2 (up to version 4.2.9).\nThe vulnerability resides in the Address Delete controller, which fails to enforce mandatory authentication, ownership validation, or CSRF protection via form keys.\nThis flaw allows remote unauthenticated attackers to delete arbitrary customer addresses from the database.\nThe attack is executed by sending a crafted GET request to a predictable URL endpoint.\nThe impact is significant, as it enables unauthorized data destruction and potential mass deletion of customer information by iterating through sequential address identifiers.\nNo specific privileges or authentication tokens are required to exploit this vulnerability, making it accessible to any external attacker with network access to the target Magento installation.\nThe root cause is the improper extension of the legacy Action class rather than the secure AbstractAccount class, which is standard for protected customer-facing controllers in Magento 2.",
  "technicalDetails": "The vulnerability is located within the Address Delete controller of the mageplaza/module-gdpr extension. In Magento 2, controllers handling account-specific actions must typically extend the \\Magento\\Customer\\Controller\\AbstractAccount class. This base class is designed to enforce the checkCustomerSession() method, which verifies the user's authentication status and ensures that the requested action is authorized for the logged-in session.\nThe defective controller implementation incorrectly extends the generic legacy Action class. By bypassing the AbstractAccount inheritance, the module fails to invoke the necessary security filters that validate the customer's identity and active session. Consequently, the controller does not verify if the requestor has ownership of the address identified by the 'id' parameter.\nThe exploitation process is straightforward and does not require complex payloads. An attacker can initiate a GET request to the URI path /customer/address/delete/id/{id}. Because the application lacks a form key validation check for this GET-based deletion, the controller proceeds to process the delete command immediately upon receipt.\nThe vulnerability is exacerbated by the predictability of the {id} parameter. An attacker can perform automated enumeration, iterating through consecutive integer IDs to systematically delete all stored customer addresses within the database. Since the controller executes with the privileges of the web server application, it possesses sufficient authorization to modify the underlying database tables without further restriction.\nThe scope of impact includes unauthorized data loss and potential disruption of service for legitimate customers. Because the vulnerability is reachable over the network and requires zero-day authentication, it presents a high risk to data integrity. The lack of form key enforcement further exposes the system to unauthorized state-changing requests, facilitating automated attacks against the customer database.\nThis issue affects all versions of mageplaza/module-gdpr up to and including version 4.2.9. The vulnerability is fundamentally a failure in secure coding practices related to session management and controller access control policies within the Magento framework's Model-View-Controller architecture."
}