medium4.3
CVE-2026-107788
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user suc…
Impact
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide.
Affected products
| Product | Affected versions |
|---|---|
| SmartyParcel WordPress Plugin | before 1.23.4 |
Versions were read from the advisory text. No structured product data has been published for this record yet.