This vulnerability exists in the blogComments GraphQL query of the Magefan Blog GraphQL module for Magento 2, versions through 2.2.1. It permits remote attackers without authentication to retrieve sensitive data including email addresses of blog commenters and internal identifiers for customers and administrators by sending a crafted POST request to the /graphql endpoint. The CVSS v3.1 base score is 7.5, indicating a high severity information disclosure issue. No official patch or remediation level has been published as of the data provided.

Successful exploitation results in unauthorized disclosure of sensitive information such as email addresses and internal identifiers related to customers and administrators. This can lead to privacy violations and potentially facilitate further targeted attacks or social engineering. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the /graphql endpoint or implementing additional access controls to prevent unauthenticated queries to the blogComments query. Monitor vendor channels for updates and apply official patches once released.