CVE-2026-16981
Received Received - Intake

DHL Shipping Germany for WooCommerce Plugin Unauthorized Shipping Label Access

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: WPScan

Description
The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not perform any authorization check (no capability, nonce, login, or ownership check) on one of its shipping-label download endpoints, so an unauthenticated attacker can enumerate sequential ids and download every stored shipping label, each containing the customer's full name, complete postal address, and order reference.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-16981
EUVD
EUVD-2026-53113

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the DHL Shipping Germany for WooCommerce WordPress plugin before version 4.0.1. It allows unauthenticated attackers to download shipping labels by guessing sequential IDs. The plugin fails to check authorization before granting access to these labels.

Detection Guidance

Check if the DHL Shipping Germany for WooCommerce plugin version is below 4.0.1. Inspect network traffic for unauthorized access attempts to shipping-label download endpoints by monitoring requests to paths like /wp-admin/admin-ajax.php?action=dhl_shipping_download_label with sequential IDs.

Impact Analysis

Unauthenticated attackers can access and download shipping labels containing sensitive customer data such as full names, complete postal addresses, and order references. This exposes private customer information and could lead to privacy breaches or identity theft.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to personal and protected health information. GDPR requires protection of personal data, while HIPAA mandates safeguards for health-related data. The exposure of customer details could result in legal penalties and compliance violations.

Mitigation Strategies

Update the DHL Shipping Germany for WooCommerce plugin to version 4.0.1 or later immediately. Review server logs for suspicious activity related to label downloads. Implement additional access controls or monitoring on the affected endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16981. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart