Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: SmartyParcel 1.23.4 Clear all filters
TI-2026-78611 CVE-2026-107789 · GHSA-v56r-ggmc-wwxc

Missing authorisation in SmartyParcel exposes shipping labels

Priority LOW 30

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00312 Published 2026-10-21 Fixed in 1.23.4 CWE-639
TI-2026-78610 CVE-2026-107788 · GHSA-f3mr-85qm-w65x

Missing authorization in SmartyParcel allows shipping label deletion

Priority LOW 20

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking r…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00245 Published 2026-10-21 Fixed in 1.23.4 CWE-862