CVE-2026-107789: medium-severity vulnerability in SmartyParcel
SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR
Published
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.3%
exploitation probability
0.3%top 76% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Unknown · SmartyParcelpublic PoCs found — 1
cve_referencewpscan.com/vulnerability/bce3568a-2fbd-40b7-927d-9f52d30d95c9/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — SmartyParcel
In the same product, most dangerous first.