CVE-2026-107789 SmartyParcel CVE debrief

Who should care

Defenders responsible for WordPress plugin management and security, particularly those managing SmartyParcel plugin deployments, should assess exposure and prioritize verification and remediation to prevent potential exploitation. This includes reviewing plugin versions, restricting access to shipping label downloads, and monitoring for unauthorized access. Security teams should also consider compensating controls for exposed systems and track exceptions.

Why it matters

CVE-2026-107789 is a vulnerability in the SmartyParcel WordPress plugin that allows unauthenticated users to access shipping labels, potentially exposing sensitive customer information. Defenders should prioritize verification and remediation to prevent potential exploitation.

• Potential unauthorized access to sensitive customer information
• Possible exploitation by unauthenticated users
• Need for verification of SmartyParcel plugin versions
• Potential impact on customer data confidentiality

Technical summary

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers. This could lead to unauthorized access to sensitive customer information. Defenders should prioritize verifying SmartyParcel plugin versions and restricting access to shipping label downloads to prevent potential exploitation. Affected product deployments should be identified and owners assigned for follow-up.

Defensive priority

Defenders should prioritize verifying SmartyParcel plugin versions and restricting access to shipping label downloads.

Recommended defensive actions

• Verify SmartyParcel plugin version and update to 1.23.4 or later
• Restrict access to shipping label downloads
• Monitor for unauthorized access to shipping labels
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record and source item provide details on the vulnerability in SmartyParcel WordPress plugin before 1.23.4. Additional verification is needed to confirm affected versions and potential impact. Defenders should verify SmartyParcel plugin versions, review shipping label downloads for unauthorized access, and monitor for potential exploitation. Evidence limits suggest focusing on CVE and source-item details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.