Smartyparcel
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:smartyparcel:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Smartyparcel (14b40b43-27dc-518e-966e-55a8f2e6719d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-107789 |
vulnerable | 2026-11-03 10:15:59.449288 |
SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers.
Published: 2026-10-21T06:00:20.660Z
Updated: 2026-10-21T10:35:05.297Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-107788 |
vulnerable | 2026-11-03 10:15:59.409306 |
SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide.
Published: 2026-10-21T06:00:20.487Z
Updated: 2026-10-21T10:35:05.455Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.