CVE-2026-16993
DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Disclosure via Unprotected Uploads Directory
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not protect its shipping-label storage directory with server-independent access control, relying only on an Apache .htaccess file, so on a web server that does not honor .htaccess (such as nginx) an unauthenticated visitor can download stored shipping labels (each containing a customer's name and postal address) by requesting predictable filenames.
| Vendor | unknown |
| Product | dhl shipping germany for woocommerce |
| Published | Aug 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown dhl shipping germany for woocommerce
Be the first to know when new unknown vulnerabilities affecting unknown dhl shipping germany for woocommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / DHL Shipping Germany for WooCommerce
0 < 4.0.1
References
Credits
Artus KG WPScan