CVE-2026-16981

UNKNOWN 0.0

DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Download via IDOR

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not perform any authorization check (no capability, nonce, login, or ownership check) on one of its shipping-label download endpoints, so an unauthenticated attacker can enumerate sequential ids and download every stored shipping label, each containing the customer's full name, complete postal address, and order reference.

Vendor	unknown
Product	dhl shipping germany for woocommerce
Published	Aug 5, 2026

Stay Ahead of the Next One

Get instant alerts for unknown dhl shipping germany for woocommerce

Be the first to know when new unknown vulnerabilities affecting unknown dhl shipping germany for woocommerce are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / DHL Shipping Germany for WooCommerce

0 < 4.0.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/61b3228d-50a0-4928-977a-23448939dff9/

Credits

Pedro Pinho Artus KG WPScan