A missing authorization check in the Address Delete controller allows remote, unauthenticated attackers to delete any customer’s saved address and to erase all stored addresses by iterating the address ID via a GET request to /customer/address/delete/id/{id}. The controller inherits from a legacy class that does not enforce authentication, ownership, or form‑key validation, meaning attackers can exploit this flaw without any credential or session. The impact is loss of customer data and potential privacy violations, as attackers can remove customers’ shipping or billing addresses, affecting operational workflows and user experience.

Mageplaza GDPR module (mageplaza/module-gdpr) for Magento 2, up to and including 4.2.9. No specific lower bound is provided, so all earlier versions are likely affected.

The vulnerability’s lack of authentication or ownership checks allows attackers to delete arbitrary customer addresses. No authentication is required, making the attack trivial from a technical standpoint. The CVSS score of 7.5 indicates high severity, underscoring the serious impact of the vulnerability. Attack likelihood is significant in a Magento environment where the module is active. The vulnerability is not currently catalogued in CISA’s KEV list, but the impact justifies urgent remedial action.