CVE-2026-79323

Published: Sep 9, 2026Modified: Sep 10, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 (magefan/module-blog-graph-ql) through 2.2.1 allows remote unauthenticated attackers to obtain blog commenter email addresses and internal customer and admin identifiers via a POST request to /graphql.

Affected (1)

Products: Mageplaza: Magefan Blog

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mageplaza Magefan Blog	Up to 2.2.1

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://gist.github.com/mrtantoine/4331a5f04f8309eb1799b257a7371f34

Source: cve@mitre.org

MitigationThird Party Advisory

https://magefan.com/magento2-blog-extension

Source: cve@mitre.org

Product

Timeline

No history available yet.