Live › vulnerability › CVE-2026-107788
Go to dashboardThe SmartyParcel WordPress plugin before 1.23.4 does not check permissions when deleting shipping label records. Any authenticated user, including a subscriber, can delete shipping label and tracking records for orders across the store.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the SmartyParcel WordPress plugin before 1.23.4 that allow user registration or have any authenticated accounts. The flaw needs only a logged-in account of any role, so sites with only administrator accounts face less exposure. Sites that do not run SmartyParcel can skip it.
No product ranges from the sources yet.
1.23.4 are affected.1.23.4 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide.
This page as .md · .json · in your agent: get_signal("CVE-2026-107788")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.