This vulnerability is an SQL injection (CWE-89) in the Mageplaza Blog extension for Magento 2 (mageplaza/magento-2-blog-extension) up to version 4.3.2. The flaw exists in the RelatedProduct block, where the id parameter passed to the /mpblog/post/view endpoint is not properly sanitized, enabling remote attackers without authentication to execute arbitrary SQL commands and access database contents. The CVSS 3.1 score is 8.6, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability.

Successful exploitation allows remote unauthenticated attackers to execute arbitrary SQL commands, potentially leading to unauthorized disclosure of sensitive database information, partial data integrity loss, and partial denial of service conditions. This compromises the confidentiality, integrity, and availability of the affected system's data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Users should monitor Mageplaza's official channels for updates and apply patches once available. Until then, consider restricting access to the vulnerable endpoint or implementing web application firewall rules to detect and block SQL injection attempts targeting the id parameter.