---
id: CVE-2026-107789
title: SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR
summary: >-
  The SmartyParcel  WordPress plugin before 1.23.4 does not perform
  authorisation checks when serving shipping label downloads, allowing
  unauthenticated users to obtain the shipping labels of arbitrary orders, which
  contain customer names,…
severity: none
cwe:
  - CWE-639
product: SmartyParcel
affected:
  - SmartyParcel < 1.23.4
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T06:00:20.660Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-107789'
references:
  - url: 'https://wpscan.com/vulnerability/bce3568a-2fbd-40b7-927d-9f52d30d95c9/'
tags:
  - cve.org
ingestedAt: '2026-10-21T06:42:48.182Z'
---

## Overview

The SmartyParcel  WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers.

## Affected

- `SmartyParcel < 1.23.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.