WordPress Plugin Vulnerabilities

SmartyParcel – Multi-Carrier Shipping, Order Tracking & Live Rates for WooCommerce < 1.23.4 - Authenticated (Subscriber+) Insecure Direct Object Reference

Description

The SmartyParcel – Multi-Carrier Shipping, Order Tracking & Live Rates for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.23.3. This is due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
wc-ukr-shipping
Fixed in 1.23.4

References

CVE
CVE-2026-84836
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/6d8c0198-0109-4e5d-af62-bb2c4b994840

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Nguyen Ba Khanh
Verified
No
WPVDB ID
74301bf9-3976-4a7f-8ef0-69c9beb0f294

Timeline

Publicly Published
2026-09-03 (about 1 month ago)
Added
2026-09-09 (about 1 month ago)
Last Updated
2026-10-13 (about 3 days ago)

Other

Published
Title
Published
2026-08-14
Title
WP Crowdfunding < 2.2.1 - Unauthenticated Insecure Direct Object Reference
Published
2023-04-03
Title
WP FEvents Book <= 0.46 - Subscriber+ Arbitrary Booking Manipulation via IDOR
Published
2026-05-13
Title
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses < 4.3.6 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter
Published
2025-02-23
Title
Filebird < 6.4.6 - Authenticated (Author+) Insecure Direct Object Reference
Published
2026-10-08
Title
Portfolio Filter Gallery 2.0.2 - 2.2.0 - Contributor+ Cross-User Video Thumbnail Deletion via pfg_delete_video_thumbnail