Live › vulnerability › CVE-2026-107789
Go to dashboardThe SmartyParcel WordPress plugin before 1.23.4 serves shipping label downloads without checking who is asking. An unauthenticated visitor can fetch the shipping label for any order, which exposes customer names, addresses and phone numbers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Stores that run the SmartyParcel WordPress plugin before 1.23.4 and generate shipping labels through it are exposed. The sources do not say whether the flaw needs any particular store setting, so treat any site with the plugin installed as in scope. Sites that do not use the plugin can skip it.
No product ranges from the sources yet.
wp plugin get smarty-parcel --field=version (plugin slug unknown from sources, confirm it)1.23.4 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers.
This page as .md · .json · in your agent: get_signal("CVE-2026-107789")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.