What is GHSA-v56r-ggmc-wwxc?

GHSA-v56r-ggmc-wwxc is a security advisory published by GitHub Security Advisories with Medium severity. The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when...

Which CVE IDs does GHSA-v56r-ggmc-wwxc cover?

GHSA-v56r-ggmc-wwxc covers the following CVE IDs: CVE-2026-107789. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-v56r-ggmc-wwxc?

GHSA-v56r-ggmc-wwxc has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-v56r-ggmc-wwxcMediumCVSS 5.3

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when...

Vendor

GitHub Security Advisories

Published

October 21, 2026

Last Modified

October 21, 2026

🔗 CVE IDs covered (1)

CVE-2026-107789 →

📋 Description

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone numbers.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-107789
https://wpscan.com/vulnerability/bce3568a-2fbd-40b7-927d-9f52d30d95c9
https://github.com/advisories/GHSA-v56r-ggmc-wwxc