CVE-2026-107789
Deferred Deferred - Pending Action

Unauthenticated Access to Sensitive Shipping Data in SmartyParcel WordPress Plugin

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: WPScan

Description
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-21
Last Modified
2026-10-21
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-09
NVD
CVE-2026-107789
EUVD
EUVD-2026-107063

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown SmartyParcel 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Insecure Direct Object Reference (IDOR) vulnerability in the SmartyParcel WordPress plugin versions below 1.23.4. It allows unauthenticated users to access and download shipping labels for any order without proper authorization. These labels contain sensitive customer data like names, addresses, and phone numbers.

Detection Guidance

Check if your SmartyParcel WordPress plugin version is below 1.23.4 by inspecting the plugin files or WordPress admin panel. Look for unauthorized access to shipping label downloads by reviewing server logs for requests to paths like /wp-content/plugins/smartparcel/downloads/ or similar endpoints.

Impact Analysis

Unauthenticated attackers could exploit this to steal customer shipping labels containing personal information such as names, addresses, and phone numbers. This could lead to privacy breaches, identity theft, or targeted phishing attacks against customers.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and potential failure to implement adequate security measures. It may also breach HIPAA if customer addresses or contact details are considered protected health information in certain contexts.

Mitigation Strategies

Update the SmartyParcel plugin to version 1.23.4 or later immediately. If updating is not possible, disable the plugin until an update is applied. Review all shipping labels for unauthorized access and notify affected customers if their data was exposed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107789. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...