Smartyparcel
Monthly
Missing authorization in the SmartyParcel WordPress plugin before 1.23.4 allows unauthenticated remote attackers to download shipping labels belonging to arbitrary orders, exposing customer names, addresses and phone numbers. The flaw is a classic insecure direct object reference (CWE-639) affecting any site running the plugin with generated labels in place; publicly available exploit code exists, and CISA KEV status does not apply, so active exploitation in the wild is not confirmed. With a CVSS base score of 5.3 (confidentiality-only impact), EPSS-style urgency should be moderate, but the privacy and regulatory implications of leaked shipping data make timely patching worthwhile.
Missing authorization checks in the SmartyParcel WordPress plugin before version 1.23.4 let any authenticated user - including a default subscriber - delete shipping label and tracking records belonging to arbitrary orders across the entire store. Because the vulnerable code path performs no capability or ownership validation, an attacker only needs a valid low-privilege account, which is trivially self-provisioned on stores that leave WordPress user registration open. Publicly available exploit code exists, and the impact is confined to integrity loss (records deleted, no data disclosure or site takeover), consistent with the CVSS 4.3 score (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N); no confirmed active exploitation (CISA KEV) has been reported.
Missing authorization in the SmartyParcel WordPress plugin before 1.23.4 allows unauthenticated remote attackers to download shipping labels belonging to arbitrary orders, exposing customer names, addresses and phone numbers. The flaw is a classic insecure direct object reference (CWE-639) affecting any site running the plugin with generated labels in place; publicly available exploit code exists, and CISA KEV status does not apply, so active exploitation in the wild is not confirmed. With a CVSS base score of 5.3 (confidentiality-only impact), EPSS-style urgency should be moderate, but the privacy and regulatory implications of leaked shipping data make timely patching worthwhile.
Missing authorization checks in the SmartyParcel WordPress plugin before version 1.23.4 let any authenticated user - including a default subscriber - delete shipping label and tracking records belonging to arbitrary orders across the entire store. Because the vulnerable code path performs no capability or ownership validation, an attacker only needs a valid low-privilege account, which is trivially self-provisioned on stores that leave WordPress user registration open. Publicly available exploit code exists, and the impact is confined to integrity loss (records deleted, no data disclosure or site takeover), consistent with the CVSS 4.3 score (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N); no confirmed active exploitation (CISA KEV) has been reported.