SmartyParcel EUVD-2026-107062

Requires a valid authenticated account of at least subscriber level on a site running SmartyParcel before 1.23.4; exposure is greatest where open user self-registration is enabled (common on e-commerce stores), since an attacker can then provision their own low-privilege account. No other special configuration, feature toggle, or admin privilege is needed, and no victim interaction is required. Limiting factors: the PR:L requirement means fully anonymous exploitation is not possible, and impact is confined to deletion of shipping-label and tracking records (integrity loss), with no data disclosure or site takeover.

This is a genuine but moderate-priority issue, best characterized as a low-privilege broken-access-control flaw rather than a critical threat. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) is internally consistent with the description: network-reachable, low complexity, no user interaction, but requiring an authenticated account (PR:L - e.g. a subscriber) and yielding only a limited integrity impact (C:N/A:N, I:L) via unauthorized deletion of shipping-label and tracking records. Publicly available exploit code exists (WPScan), which raises real-world likelihood, but there is no CISA KEV listing and no EPSS score was supplied, so there is no evidence of active or widespread exploitation - treat the POC as a capability signal, not proof of attacks in the wild. No SSVC decision data was provided. The practical risk is bounded by two factors: an attacker needs a valid low-privilege account (so exposure is highest on stores allowing open user registration, such as WooCommerce-style shops), and the damage is destructive-but-limited (record deletion), with no data disclosure or full site compromise. Net: patch promptly on affected stores, especially those with open registration, but this does not rise to emergency severity.

An attacker registers or uses an existing low-privilege subscriber account on a WordPress store running SmartyParcel before 1.23.4, then issues the plugin's label-deletion request referencing order IDs they do not own. Because no authorization check is performed, the request succeeds and wipes shipping-label and tracking records for arbitrary orders store-wide, disrupting fulfillment operations. Public exploit code is available via WPScan, lowering the skill needed to reproduce this.