UNKNOWN NVD

CVE-2026-107789

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers.

References

https://wpscan.com/vulnerability/bce3568a-2fbd-40b7-927d-9f52d30d95c9/

Published: 2026-10-21 · Source: NVD · Feed updated: 2026-10-21

This unknown severity vulnerability was published on 2026-10-21 via NVD.

vulnfeed aggregates 17594 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.