The vulnerability stems from the SmartyParcel WordPress plugin failing to enforce proper authorization when a delete operation on shipping label records is requested. As a result, any authenticated user, including those with a subscriber role, can trigger the deletion of shipping labels and associated tracking information for any order across the entire store. This flaw aligns with missing access control, allowing data to be removed without consent, which could impair order fulfillment processes and damage customer trust.

The affected product is the SmartyParcel plugin for WordPress, version 1.23.4 and all earlier releases. The issue applies to any installation of the plugin before the security update that implements the necessary authorization checks. Users running older versions should verify their plugin version and apply the update or remove the plugin if it is not required.

Because the flaw is accessed through authenticated user sessions, the attack vector is an internal user or a legitimate subscriber account. No external exploitation is required, but any user with access to the site can delete data at will. The absence of an EPSS score and KEV listing does not diminish the business impact; the loss of shipping and tracking records can disrupt logistics and lead to financial loss or reputational damage. The severity is effectively high given the scope of store-wide data loss.