CVE-2026-107788
SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide.
| Vendor | unknown |
| Product | smartyparcel |
| Published | Oct 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown smartyparcel
Be the first to know when new unknown vulnerabilities affecting unknown smartyparcel are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / SmartyParcel
0 < 1.23.4
References
Credits
Andy Urlep WPScan