Unrated severityNVD Advisory· Published Oct 21, 2026

CVE-2026-107788

Description

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/SmartyParcelllm-create
Range: <1.23.4

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/64fd7acb-2376-45a5-9fe7-9eea12ec7920/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000