{"id":"CVE-2026-107789","kind":"vulnerability","aliases":["CVE-2026-107789"],"related":[],"title":"SmartyParcel WordPress plugin leaks shipping labels without authorisation checks","description":"The SmartyParcel  WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers.","summary":"The SmartyParcel WordPress plugin before 1.23.4 serves shipping label downloads without checking who is asking. An unauthenticated visitor can fetch the shipping label for any order, which exposes customer names, addresses and phone numbers.","severity":"medium","cvss":5.3,"epss":0.00245,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","package","shipping","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","version-1.23.4-or-later"],"how_to_check":"- Check the installed SmartyParcel version in the WordPress admin plugin list or with `wp plugin get smarty-parcel --field=version` (plugin slug unknown from sources, confirm it)\n- Look for the plugin's label download endpoint in the access log and see whether it returns files to logged-out requests","fix":"- Update the SmartyParcel plugin to `1.23.4` or later\n- If the update cannot be applied, disable the plugin until it is","status":"open","published_at":"2026-10-21T06:16:47+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:21:12+00:00","updated_at":"2026-10-25T04:21:12+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:21:12Z","model":"claude-haiku-5-5","output":{"fix":"- Update the SmartyParcel plugin to `1.23.4` or later\n- If the update cannot be applied, disable the plugin until it is","reach":"internet","title":"SmartyParcel WordPress plugin leaks shipping labels without authorisation checks","impact":"medium","summary":"The SmartyParcel WordPress plugin before 1.23.4 serves shipping label downloads without checking who is asking. An unauthenticated visitor can fetch the shipping label for any order, which exposes customer names, addresses and phone numbers.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","ecommerce","shipping"],"confidence":0.8,"needs_auth":"no","worst_case":"Anyone can download customer shipping labels with names, addresses and phone numbers","analyst_note":"","how_to_check":"- Check the installed SmartyParcel version in the WordPress admin plugin list or with `wp plugin get smarty-parcel --field=version` (plugin slug unknown from sources, confirm it)\n- Look for the plugin's label download endpoint in the access log and see whether it returns files to logged-out requests","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-1.23.4-or-later"],"who_is_affected":"Stores that run the SmartyParcel WordPress plugin before 1.23.4 and generate shipping labels through it are exposed. The sources do not say whether the flaw needs any particular store setting, so treat any site with the plugin installed as in scope. Sites that do not use the plugin can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000625,"input_tokens":3352,"output_tokens":579,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-107789':12A,15A '-2026':11A,14A '1.23.4':26B,60C 'address':51B,86C 'allow':71C 'arbitrari':80C 'ask':35B 'authoris':8A,64C 'check':9A,32B,65C 'contain':83C 'custom':49B,84C 'cve':10A,13A 'download':30B,70C 'ecommerc':16B 'expos':48B 'fetch':40B 'label':6A,29B,43B,69C,78C 'leak':4A 'name':50B,85C 'number':54B,89C 'obtain':75C 'order':46B,81C 'packag':17B 'perform':63C 'phone':53B,88C 'plugin':3A,24B,58C 'serv':27B,67C 'ship':5A,18B,28B,42B,68C,77C 'smartyparcel':1A,22B,56C 'unauthent':37B,72C 'user':73C 'visitor':38B 'without':7A,31B 'woocommerc':19B 'wordpress':2A,20B,23B,57C","nicknames":[],"mitigations":[],"who_affected":"Stores that run the SmartyParcel WordPress plugin before 1.23.4 and generate shipping labels through it are exposed. The sources do not say whether the flaw needs any particular store setting, so treat any site with the plugin installed as in scope. Sites that do not use the plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T06:16:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107789","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107789","severity":null,"published_at":"2026-10-21T06:16:47+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-107789","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107789","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}