https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-79324.htmlhttps://patchthecve.com/cve/CVE-2026-79324.htmlThu, 10 Sep 2026 17:48:38 +0000HIGH 7.5: Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 (mageplaza/module-gdpr) through 4.2.9 allows remote unauthenticated attackers to delete any customer's saved address, and to erase all stored addresses by iterating the address id, via a GET request to /customer/ahttps://patchthecve.com/cve/CVE-2026-79323.htmlhttps://patchthecve.com/cve/CVE-2026-79323.htmlThu, 10 Sep 2026 17:48:35 +0000HIGH 7.5: Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 (magefan/module-blog-graph-ql) through 2.2.1 allows remote unauthenticated attackers to obtain blog commenter email addresses and internal customer and admin identifiers via a POST request to /graphql.https://patchthecve.com/cve/CVE-2026-79322.htmlhttps://patchthecve.com/cve/CVE-2026-79322.htmlThu, 10 Sep 2026 17:48:32 +0000HIGH 8.6: SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 (mageplaza/magento-2-blog-extension) through 4.3.2 allows remote unauthenticated attackers to execute arbitrary SQL commands and read arbitrary database contents via the id parameter to /mpblog/post/view.