CVE-2026-16993
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The DHL Shipping Germany for WooCommerce plugin before version 4.0.1 does not protect its shipping-label storage directory with server-independent access control, relying only on an Apache .htaccess file. On servers that do not honor .htaccess (e.g., nginx), an unauthenticated visitor can download stored shipping labels (containing customer name and postal address) by requesting predictable filenames.
Risk Assessment
Exposure of customer personal data (name and address) may violate data protection regulations and harm the company's reputation.
Recommendation
Update the plugin to version 4.0.1 or later and implement additional server-independent access control mechanisms.
Original NVD description (English source)
The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not protect its shipping-label storage directory with server-independent access control, relying only on an Apache .htaccess file, so on a web server that does not honor .htaccess (such as nginx) an unauthenticated visitor can download stored shipping labels (each containing a customer's name and postal address) by requesting predictable filenames.