Vulnerability · Published Oct 21, 2026 · Assigned by WPScan

CVE-2026-107788SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion

Medium 4.3

In plain English

A medium-severity missing authorization in SmartyParcel from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 84.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide.

Affected products (as reported)

Vendor	Product	Versions
Unknown	SmartyParcel	0 – before 1.23.4

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://wpscan.com/vulnerability/64fd7acb-2376-45a5-9fe7-9eea12ec7920/ exploit, vdb-entry, technical-description