A missing authorization check in the SmartyParcel WordPress plugin permits any unauthenticated user to download shipping labels for arbitrary orders, revealing customer names, addresses and phone numbers. This flaw (CWE‑639) directly violates confidentiality and enables an attacker to harvest personal data without needing credentials or special access.

The issue affects installations of the SmartyParcel WordPress plugin before version 1.23.4. All sites hosting the plugin in these earlier versions are susceptible.

The CVSS score is 5.3, indicating a moderate severity, and the EPSS score is less than 1%, implying low probability of exploitation at the time of analysis. The vulnerability is not listed in CISA KEV. The attack likely proceeds via a web request to the label download endpoint, requiring no user authentication. Because the endpoint lacks proper authorization checks, exploitation is trivial for any internet‑connected party, although the low EPSS score suggests low current exploitation activity. Updating the plugin removes the flaw and mitigates the risk.