CVE-2026-107789 in SmartyParcel Plugin
Summary
by MITRE • 10/21/2026
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
SmartyParcel is a widely used WordPress plugin designed to streamline e-commerce logistics by integrating with various carriers for automated shipping label generation. The vulnerability identified in versions prior to 1.23.4 stems from an insecure direct object reference mechanism within the application's endpoint responsible for serving shipping labels. Specifically, when a user requests a download of a shipping label, the plugin fails to verify whether the requesting user has administrative privileges or ownership over the specific order associated with that label. This lack of authorization checks allows any unauthenticated actor on the internet to interact directly with the underlying file system by manipulating parameters in the request URL.
The technical flaw lies in the absence of access control validation before processing the download request. The application accepts an identifier for a shipping document and immediately serves the corresponding PDF or image file without checking if the session token, cookie, or user role associated with the current HTTP connection permits such action. This is a classic implementation error where the server trusts client-supplied input regarding resource ownership rather than enforcing strict identity-based access policies on the backend. Consequently, an attacker can iterate through sequential order IDs to enumerate and download shipping labels belonging to any customer in the system's database.
The operational impact of this vulnerability is severe due to the sensitive nature of the data contained within shipping labels. These documents typically include full names, physical home or business addresses, phone numbers, and sometimes email addresses of customers who have made purchases through the affected WordPress site. The exposure of personally identifiable information violates privacy regulations such as GDPR in Europe or CCPA in California, potentially leading to significant legal liabilities for the website owner. Furthermore, this data leakage facilitates targeted phishing attacks, social engineering campaigns, and physical security threats against individuals whose private contact details are now publicly accessible via automated scraping tools.
From a classification perspective, this vulnerability aligns with CWE-284, which describes Improper Access Control, specifically highlighting the failure to enforce proper authorization checks for critical functions. It also maps directly to MITRE ATT&CK technique T1078, Valid Accounts, although in this case, it affects unauthenticated users due to a misconfiguration rather than compromised credentials. The attack vector is classified as remote and exploitable with low complexity, requiring no special privileges or user interaction beyond accessing the vulnerable URL structure.
To mitigate this risk immediately, administrators of websites running SmartyParcel must upgrade the plugin to version 1.23.4 or later, where the authorization logic has been corrected to validate user permissions before serving sensitive documents. Until an update is applied, site owners should consider implementing web application firewall rules that restrict access to shipping label endpoints to authenticated administrative users only. Additionally, it is advisable to audit recent server logs for signs of automated scanning activity targeting these endpoints and notify affected customers if their data has likely been exposed during the window of vulnerability exposure. Regular security audits and adherence to secure coding standards are essential to prevent similar information disclosure flaws in future development cycles.