CVE-2026-107788
Deferred Deferred - Pending Action

Authentication Bypass in SmartyParcel WordPress Plugin

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: WPScan

Description
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-21
Last Modified
2026-10-21
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-09
NVD
CVE-2026-107788
EUVD
EUVD-2026-107062

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown SmartyParcel 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the SmartyParcel WordPress plugin before version 1.23.4 allows any authenticated user, including low-privilege users like subscribers, to delete shipping label and tracking records for any order across the store without proper authorization checks. This is due to broken access control, meaning the plugin fails to verify if a user has permission to perform such actions.

Detection Guidance

Check if the SmartyParcel plugin version is below 1.23.4. Use WordPress admin dashboard or run: wp plugin list | grep smartyparcel. If installed, verify user roles with access to delete shipping labels.

Impact Analysis

An attacker could exploit this to delete critical shipping and tracking data for orders, potentially disrupting order fulfillment, causing financial losses, or damaging customer trust. Even non-admin users with minimal access could perform these actions.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if shipping or tracking data is deleted, as these regulations often require accurate record-keeping for transactions or personal data. Loss of such records may violate retention or audit requirements.

Mitigation Strategies

Update the SmartyParcel plugin to version 1.23.4 or later immediately. Review user roles and remove unnecessary permissions for subscribers or lower-level users to prevent unauthorized deletions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107788. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...