Executive brief
Mageplaza Blog is a popular Magento 2 extension used to publish blog posts and manage content on e-commerce sites. An SQL injection vulnerability in the RelatedProduct feature allows unauthenticated attackers to execute arbitrary database queries and read sensitive data such as customer information, orders, and admin credentials without authentication or user interaction. This can lead to complete database compromise and customer data exposure.
Technical details
A SQL injection vulnerability exists in the RelatedProduct block (Block/Post/RelatedProduct.php, line 160) where the 'id' query parameter is concatenated directly into a Zend_Db_Select WHERE clause without parameterized binding: `->where('product_post.post_id = ' . $postId)`. An unauthenticated remote attacker can exploit this via HTTP GET requests to `/mpblog/post/view?id=<SQL_PAYLOAD>` to inject arbitrary SQL commands. The vulnerability has been verified through time-based blind SQL injection (SLEEP function), confirming queries reach the database verbatim. Precondition: the target post must have at least one related product configured. No patch is available; the recommended fix is to use parameter binding instead of string concatenation.
Affected products
- Mageplaza Blog for Magento 2 through 4.3.2
Timeline
- 2026-09-09: disclosed
- other: No patched version available as of advisory date