---
id: "CVE-2026-107789"
kind: "vulnerability"
aliases: ["CVE-2026-107789"]
title: "SmartyParcel WordPress plugin leaks shipping labels without authorisation checks"
severity: "medium"
cvss: 5.3
epss: 0.00245
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ecommerce", "package", "shipping", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed", "version-1.23.4-or-later"]
published_at: "2026-10-21T06:16:47+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T04:21:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107789", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-107789", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# SmartyParcel WordPress plugin leaks shipping labels without authorisation checks

The SmartyParcel WordPress plugin before 1.23.4 serves shipping label downloads without checking who is asking. An unauthenticated visitor can fetch the shipping label for any order, which exposes customer names, addresses and phone numbers.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed SmartyParcel version in the WordPress admin plugin list or with `wp plugin get smarty-parcel --field=version` (plugin slug unknown from sources, confirm it)
- Look for the plugin's label download endpoint in the access log and see whether it returns files to logged-out requests

## Fix

- Update the SmartyParcel plugin to `1.23.4` or later
- If the update cannot be applied, disable the plugin until it is

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107789
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-107789

## From the sources

The SmartyParcel  WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_