CVE-2026-107789
SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers.
| Vendor | unknown |
| Product | smartyparcel |
| Published | Oct 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown smartyparcel
Be the first to know when new unknown vulnerabilities affecting unknown smartyparcel are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / SmartyParcel
0 < 1.23.4
References
Credits
Ryan Fabella WPScan