WordPress Plugin Vulnerabilities

SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR

Description

The plugin does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers.

Proof of Concept

Affects Plugins

Plugin icon
wc-ukr-shipping
Fixed in 1.23.4

References

CVE
CVE-2026-107789

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Ryan Fabella
Submitter
Ryan Fabella
Verified
Yes
WPVDB ID
bce3568a-2fbd-40b7-927d-9f52d30d95c9

Timeline

Publicly Published
2026-10-19 (about 2 days ago)
Added
2026-10-19 (about 1 day ago)
Last Updated
2026-10-19 (about 1 day ago)

Other

Published
Title
Published
2025-02-03
Title
JS Help Desk – The Ultimate Help Desk & Support Plugin < 2.8.9 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2026-08-31
Title
MasterStudy LMS < 3.7.46 - Instructor+ Quiz Answer Disclosure via IDOR
Published
2026-03-10
Title
Happy Addons for Elementor < 3.21.1 - Insecure Direct Object Reference to Authenticated (Contributor+) Stored Cross-Site Scripting via Template Conditions
Published
2026-06-02
Title
Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Download
Published
2026-05-13
Title
MW WP Form < 5.1.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'post_id' Query Parameter