CVE-2026-107788
CVE-2026-107788 · SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide.
CVSS 4.3 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
smartyparcel
- Versions
- ≥ 0, < 1.23.4: Affected (semver)
Update to 1.23.4