SmartyParcel vulnerabilities
CVEs whose affected-version data names the SmartyParcel package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-107788NoneSmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitr…
▾ Sunlitvia CVEORG
CVE-2026-107789NoneSmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names,…
▾ Sunlitvia CVEORG