Vulnerabilities CVE-2026-16981

CVE-2026-16981

None

Open

TLP:CLEAR

DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Download via IDOR

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not perform any authorization check (no capability, nonce, login, or ownership check) on one of its shipping-label download endpoints, so an unauthenticated attacker can enumerate sequential ids and download every stored shipping label, each containing the customer's full name, complete postal address, and order reference.

Details

EPSS Score ⓘ: 0.19%

9.2th percentile
Confidence: 90%
Published: Aug 5, 2026
Last Modified: Aug 6, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.