CVE-2026-107788: SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion

Q: Who can exploit this issue?

Any authenticated WordPress user, including a user with only the Subscriber role, can delete shipping-label and tracking records. The affected records can belong to arbitrary orders across the store.

Q: Is an unauthenticated attacker able to exploit it?

The issue requires an authenticated WordPress account. The provided information does not indicate that unauthenticated users can trigger the deletion.

Q: What versions are affected?

SmartyParcel (WC Ukr Shipping) versions before 1.23.4 are affected. Version 1.23.4 is the first version identified as not affected.

Published Oct 21, 2026

Updated

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide.

Affected Software

1 affected component

SmartyParcel WC Ukr Shipping<1.23.4

Event History

Oct 21, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated WordPress user, including a user with only the Subscriber role, can delete shipping-label and tracking records. The affected records can belong to arbitrary orders across the store.

Is an unauthenticated attacker able to exploit it?

The issue requires an authenticated WordPress account. The provided information does not indicate that unauthenticated users can trigger the deletion.

What versions are affected?

SmartyParcel (WC Ukr Shipping) versions before 1.23.4 are affected. Version 1.23.4 is the first version identified as not affected.

CVE-2026-107788: SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Is an unauthenticated attacker able to exploit it?

What versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Is an unauthenticated attacker able to exploit it?

What versions are affected?