The vulnerability exists in the Address Delete controller of Mageplaza GDPR for Magento 2 through version 4.2.9. The controller improperly extends the legacy Action class instead of AbstractAccount, resulting in missing authorization checks. This allows remote unauthenticated attackers to delete any customer's saved address by iterating over address IDs via GET requests to /customer/address/delete/id/{id}. This lack of authentication and ownership verification enables unauthorized deletion of stored addresses.

An attacker can remotely delete any customer's saved address data without authentication. This can lead to loss of customer data integrity and potential disruption of customer-related services relying on address information. There is no indication of privilege escalation or data disclosure beyond address deletion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and monitor for suspicious requests targeting /customer/address/delete/id/{id}.