The Magefan Blog GraphQL module for Magento 2 contains a flaw in the blogComments query that reveals email addresses of blog commenters and internal identifiers for customers and administrators. Attackers can trigger this exposure simply by issuing an unauthenticated POST request to /graphql, allowing remote collection of sensitive personal and system information without the need for authentication. This disclosure could facilitate identity theft or serve as a foothold for further attacks, as it leaks data that should be protected.

Any Magento 2 installation that has the Magefan Blog GraphQL module (magefan/module-blog-graph-ql) version 2.2.1 or earlier deployed is affected. The vulnerability persists until the module is patched to a release that blocks unauthenticated access to blog comment data.

The attack surface is a simple HTTP POST to the GraphQL endpoint, which requires no credentials and can be executed from any network connected to the site. The CVSS score of 7.5 indicates a high severity level, while the EPSS score is not available, so the exact likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Given the lack of authentication checks on the query, attackers have a high probability of exploitation in the wild if the module remains unpatched.