A missing authorization check in the SmartyParcel WordPress plugin permits any unauthenticated user to download shipping labels for arbitrary orders, revealing customer names, addresses and phone numbers. This flaw directly violates confidentiality and enables an attacker to harvest personal data without needing credentials or special access.

The issue affects installations of the SmartyParcel WordPress plugin before version 1.23.4. All sites hosting the plugin in these earlier versions are susceptible.

No CVSS score is published and the EPSS score is unavailable, while the vulnerability is not listed in CISA KEV. The attack likely proceeds via a web request to the label download endpoint, with no reliance on user authentication. Because the endpoint is insecure, exploitation is trivial and can be performed by any internet‑connected party, though the absence of an official exploit bundle suggests low current exploitation activity. Updating the plugin removes the flaw and mitigates the risk.