WordPress DHL for WooCommerce plugin < 4.0.1 - Unauthenticated Shipping Label Disclosure via Unprotected Uploads Directory vulnerability

Unauthenticated Shipping Label Disclosure via Unprotected Uploads Directory vulnerability discovered by Artus KG in WordPress Plugin DHL Shipping Germany for WooCommerce versions 4.0.1...

CVE-2026-16993 DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Disclosure via Unprotected Uploads Directory

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not protect its shipping-label storage directory with server-independent access control, relying only on an Apache .htaccess file, so on a web server that does not honor .htaccess such as nginx an unauthenticated visitor...