---
id: CVE-2026-107789
title: SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR
summary: >-
  The SmartyParcel  WordPress plugin before 1.23.4 does not perform
  authorisation checks when serving shipping label downloads, allowing
  unauthenticated users to obtain the shipping labels of arbitrary orders, which
  contain customer names,…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: adp
cwe:
  - CWE-639
product: SmartyParcel
affected:
  - SmartyParcel < 1.23.4
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-21T10:21:54.334442Z'
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T10:35:05.297Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-107789'
references:
  - url: 'https://wpscan.com/vulnerability/bce3568a-2fbd-40b7-927d-9f52d30d95c9/'
tags:
  - cve.org
ingestedAt: '2026-10-21T06:42:48.182Z'
epss: 0.00312
epssPercentile: 0.23877
---

## Overview

The SmartyParcel  WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers.

## Affected

- `SmartyParcel < 1.23.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.