SmartyParcel CVE-2026-107789

No special conditions - remote unauthenticated exploitation against default configurations of the SmartyParcel WordPress plugin prior to 1.23.4. The only practical prerequisites are that the vulnerable plugin is installed and that orders with generated shipping labels exist to be retrieved. Exploitation is limited strictly to disclosure of shipping-label data (customer names, addresses, phone numbers); it grants no write access, code execution, or account takeover, and no authentication or user interaction is required.

Signals align consistently toward a real but moderate-priority issue rather than a critical emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3, Medium) describes a network-reachable, low-complexity, unauthenticated flaw with no user interaction - trivially exploitable - but impact is confined to low confidentiality loss (C:L) with no integrity or availability effect, matching the CWE-639 (authorization bypass / IDOR) classification. A public exploit exists (WPScan), which raises practical exploitability, but this is NOT the same as active exploitation: the CVE is not listed in CISA KEV, so exploitation status is 'publicly available exploit code exists,' not confirmed in-the-wild use. No EPSS score was supplied, so probabilistic exploitation likelihood cannot be quantified from this input - treat any exploitation-probability claim as unverified. No SSVC decision data was provided. Net: easy to exploit and POC-backed, but the ceiling is PII disclosure (customer names, addresses, phone numbers) of orders, not system compromise - a GDPR/privacy and data-exposure concern more than an RCE-grade crisis. Prioritize patching promptly where the plugin is deployed, but it does not warrant the same urgency as a critical unauthenticated RCE.

An unauthenticated attacker requests the SmartyParcel shipping-label download endpoint while iterating or guessing order identifiers, and because no authorization check is enforced, the server returns labels belonging to other customers. Each label discloses the customer's name, postal address, and phone number, enabling bulk harvesting of personal data. A public proof-of-concept is available via WPScan, lowering the skill barrier.