CVE-2026-107788

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide...

CVE-2026-107789

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers...

CVE-2026-107788

The SmartyParcel (also known as WC Ukr Shipping ) WordPress plugin before version 1.23.4 is vulnerable to an authorization bypass. The plugin fails to perform sufficient authorization checks when deleting shipping label records, which allows any authenticated user , such as a subscriber, to delet...

CVE-2026-107789

The SmartyParcel WordPress plugin, in versions prior to 1.23.4 , is vulnerable to an unauthenticated shipping label disclosure due to a lack of authorization checks. This allows attackers to obtain shipping labels for arbitrary orders, potentially exposing sensitive customer information such as n...

CVE-2026-107788 SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide...

CVE-2026-107789 SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers...

EUVD-2026-107062

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide...

EUVD-2026-107063

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers...

PT-2026-120457

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide...

PT-2026-120458

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers...