Christian Münch / muench.dev@cmuench
CVE-2026-79322: Mageplaza_Blog for Magento 2 has an unauthenticated SQL injection (CVSS 8.6), affecting versions through 4.3.2. Upgrade to 4.3.4:
01013146
2.7K followersView on X
CVE-2026-79322(mageplaza / mageplaza_blog)
LOWCVSS 8.6 · HIGHSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 (mageplaza/magento-2-blog-extension) through 4.3.2 allows remote unauthenticated attackers to execute arbitrary SQL commands and read arbitrary database contents via the id parameter to /mpblog/post/view.
0.0/ 10 priority
Sources & remediation
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-89
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Are you affected?
If you run products in this scope, you should treat this CVE as relevant to your environment.
- mageplaza_blog
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day
Affected systems
Vendors
Products
mageplaza_blog
Deep dive
Activity timeline1 mentions / 1d
Full discourse1 post
CPE platform detail1 entries
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | mageplaza | mageplaza_blog | - | magento | - |