The SmartyParcel WordPress plugin fails to enforce authorization checks when a delete operation is issued on shipping label records, allowing any authenticated user—including a subscriber—to delete shipping labels and tracking information for any order in the store. This flaw is a missing access control weakness that can erase essential logistics data and impair order fulfillment, potentially harming customer trust.

The vulnerability affects all installations of the SmartyParcel plugin for WordPress when the plugin version is older than 1.23.4. Any site running a pre‑1.23.4 release is susceptible, as the issue is not tied to a specific site configuration but to the plugin’s code prior to the update.

The likely attack vector is an internal authenticated user with any role that can access the delete function—specifically, a subscriber role. Based on the description it is inferred that the plugin does not restrict deletion to higher‑privilege users. Because the flaw is exploitable through an existing authenticated session, no external access is required; an attacker simply needs to log in and issue a delete request. The CVSS score of 4.3 indicates low severity, yet the loss of shipping and tracking records can disrupt logistics. The EPSS score of less than 1% suggests a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog.