PatchTheCVEmageplaza vulnerabilities
Recent CVEs affecting mageplaza products. 3 tracked.
mageplaza has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2026-09-09. Highest priority: CVE-2026-79322 (score 45/100).
- CVE-2026-79324 HIGH 7.5 UPGRADE Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 (mageplaza/module-gdpr)
- CVE-2026-79323 HIGH 7.5 UPGRADE Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 (magefan/module
- CVE-2026-79322 HIGH 8.6 UPGRADE SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 (mageplaza/magento-2-blog-extension)
FAQ
How do I fix mageplaza vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is mageplaza being exploited right now?
None of the tracked mageplaza CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which mageplaza CVE should I patch first?
CVE-2026-79322 currently ranks highest (45/100): SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 (mageplaza/magento-2-blog-extension).