CVE-2026-16993

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not protect its shipping-label storage directory with server-independent access control, relying only on an Apache .htaccess file, so on a web server that does not honor .htaccess such as nginx an unauthenticated visitor...

CVE-2026-16981

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not perform any authorization check no capability, nonce, login, or ownership check on one of its shipping-label download endpoints, so an unauthenticated attacker can enumerate sequential ids and download every stored...

CVE-2026-16981

The CVE-2026-16981 entry concerns the DHL Shipping Germany for WooCommerce WordPress plugin (pre-4.0.1). The vulnerability is an unauthenticated IDOR on a shipping-label download endpoint, where no authorization checks (capability, nonce, login, or ownership) are performed, allowing an unauthenti...