SmartyParcel – DHL Express, GLS, InPost & Nova Post for WooCommerce

SmartyParcel – DHL Express, GLS, InPost & Nova Post for WooCommerce has 4 disclosed vulnerabilities in the WordSec catalog, all reported in 2026; all 4 are fixed as of October 2026. Their average CVSS score is 4.5, and the most serious one scores 5.3 out of 10. 2026 was the busiest year with 4 disclosures.

The most common weakness is Authorization Bypass Through User-Controlled Key, behind 2 of the records (50%). Other recurring categories include Missing Authorization.

Every one of the 4 issues recorded for SmartyParcel – DHL Express, GLS, InPost & Nova Post for WooCommerce has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, one record each. SmartyParcel – DHL Express, GLS, InPost & Nova Post for WooCommerce is installed on roughly 7,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
4.5/ 10
Patch Coverage100%
Open

0

Fixed

4

Get automatic notifications for all SmartyParcel – DHL Express, GLS, InPost & Nova Post for WooCommerce vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.3CVE-2026-107789

SmartyParcel <= 1.23.3 - Unauthenticated Insecure Direct Object Reference

Read the full analysis

Vulnerability Records

4 records
Plugin Profile
Latestv1.23.7

SmartyParcel – DHL Express, GLS, InPost & Nova Post for WooCommerce

kirillbdev

Author

kirillbdev

4.6(56)
92/100
Last Updated
2026-10-20 (5d ago)
Active Installs
7,000+
Downloads
180,746
Requires WP
0+
Requires PHP
8.0+
Tested up to
WP 7.1.3
Created
2019-06-06 (8y ago)

SmartyParcel helps your WooCommerce store grow by taking shipping routine off your hands. Connect your carriers and automate shipping from checkout to delivery: pickup points at checkout, one-click shipping labels, order tracking and customer notifications — all from one platform. Trusted by 7,000+ WooCommerce stores. Product Overview Supported carriers Documentation Example: setting up PostNord pickup points in the WooCommerce checkout. Features Pickup point selection built into the WooCommerce checkout — a searchable list, plus an optional Google map view. Separate shipping methods per delivery type, so “To pickup point” and “Courier to address” are two distinct options in the WooCommerce shipping zone. Points are loaded live from the carrier network, with opening hours, addresses and parcel size limits where the carrier provides them. Works with WooCommerce shipping zones, so each country gets exactly the carriers you ship there with. Create domestic and international shipping labels in a few clicks. Bulk label creation and printing (paid plans). Rule-based automation: create labels automatically on order status change, on payment, or on your own conditions. Shipping rules: prepare shipments automatically by your criteria (for example, choose the carrier by parcel weight or add extra services and more). Easy to ship from multiple sender addresses. Provide carrier live-rates at checkout for your customers (paid plans). Advanced order tracking with real-time status sync and customer notifications (Email and SMS). Supported carriers Nova Post, Нова Пошта, DHL Express, GLS, InPost, Meest, PostNord, Nova Global, Rozetka Delivery, Ukrposhta and many more. We’re continuously integrating new carriers and features! Pickup point selector at checkout (ParcelShops, Parcel Lockers, Service Points) GLS (Europe) InPost (Poland only, for now) PostNord Nova Post Nova Poshta (Ukraine) Ukrposhta Meest Rozetka Delivery Showing pickup points at checkout requires no API keys or carrier contracts. DHL Express shipping Ship worldwide with DHL Express straight from WooCommerce. Add the DHL Express shipping method to any shipping zone, pick the service type and show the shipping price at checkout — a fixed price or live DHL Express rates (paid plans), with an optional free shipping threshold. DHL Express labels and tracking are handled in SmartyParcel like for any other carrier; creating labels requires your own DHL Express account. Supported DHL Express service types: DHL Express Worldwide DHL Express 9:00 DHL Express 12:00 DHL Economy Select DHL Express Domestic Compatibility WooCommerce HPOS (High-Performance Order Storage) and legacy order storage. WPML, Polylang and multi-currency stores. PHP 8.0+, tested with the latest WordPress and WooCommerce releases. External services This plugin uses SmartyParcel API to provide advanced logistic functions (like create labels, tracking etc.) and also external API to collect user feedbacks and installation telemetry, which includes the store URL and the WordPress administrator email address (Privacy Policy).

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C