CVE-2026-16981

Received Received - Intake

DHL Shipping Germany for WooCommerce Plugin Unauthorized Shipping Label Access

Publication date: 2026-08-05

Last updated on: 2026-08-06

Assigner: WPScan

Description

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not perform any authorization check (no capability, nonce, login, or ownership check) on one of its shipping-label download endpoints, so an unauthenticated attacker can enumerate sequential ids and download every stored shipping label, each containing the customer's full name, complete postal address, and order reference.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-06

Generated

2026-08-17

AI Q&A

2026-08-05

EPSS Evaluated

2026-08-16

NVD

CVE-2026-16981

EUVD

EUVD-2026-53113

Affected Vendors & Products

Vendor	Product	Version / Range
artus_kg	dhl_for_woocommerce	to 4.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the DHL Shipping Germany for WooCommerce WordPress plugin before version 4.0.1. It allows unauthenticated attackers to download shipping labels by guessing sequential IDs. The plugin fails to check authorization before granting access to these labels.

Detection Guidance

Check if the DHL Shipping Germany for WooCommerce plugin version is below 4.0.1. Inspect network traffic for unauthorized access attempts to shipping-label download endpoints by monitoring requests to paths like /wp-admin/admin-ajax.php?action=dhl_shipping_download_label with sequential IDs.

Impact Analysis

Unauthenticated attackers can access and download shipping labels containing sensitive customer data such as full names, complete postal addresses, and order references. This exposes private customer information and could lead to privacy breaches or identity theft.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to personal and protected health information. GDPR requires protection of personal data, while HIPAA mandates safeguards for health-related data. The exposure of customer details could result in legal penalties and compliance violations.

Mitigation Strategies

Update the DHL Shipping Germany for WooCommerce plugin to version 4.0.1 or later immediately. Review server logs for suspicious activity related to label downloads. Implement additional access controls or monitoring on the affected endpoints.

Hi! I’m here to help you understand CVE-2026-16981. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70