CVE-2026-16981

MediumCVSS 5.3

Published: 05/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

The DHL Shipping Germany for WooCommerce plugin before 4.0.1 does not perform any authorization check on one of its shipping-label download endpoints. An unauthenticated attacker can enumerate sequential ids and download every stored shipping label, each containing the customer's full name, complete postal address, and order reference.

Risk Assessment

The vulnerability leads to exposure of customers' personal data (name, address, order reference), violating GDPR and potentially resulting in fines and loss of customer trust.

Recommendation

Immediately update the plugin to version 4.0.1 or later and restrict access to endpoints to authenticated users with appropriate permissions.

Other vulnerabilities in DHL Shipping Germany for WooCommerce

CVE-2026-16993Low
The DHL Shipping Germany for WooCommerce plugin before version 4.0.1 does not protect its shipping-label storage directory with server-independent access control, relying only on an Apache .htaccess file. On servers that do not honor .htaccess (e.g., nginx), an unauthenticated visitor can download stored shipping labels (containing customer name and postal address) by requesting predictable filenames.

Original NVD description (English source)

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not perform any authorization check (no capability, nonce, login, or ownership check) on one of its shipping-label download endpoints, so an unauthenticated attacker can enumerate sequential ids and download every stored shipping label, each containing the customer's full name, complete postal address, and order reference.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS