WordPress DHL for WooCommerce plugin < 4.0.1 - Unauthenticated Shipping Label Download via IDOR vulnerability

Unauthenticated Shipping Label Download via IDOR vulnerability discovered by Pedro Pinho, Artus KG in WordPress Plugin DHL Shipping Germany for WooCommerce versions 4.0.1...

CVE-2026-16993

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not protect its shipping-label storage directory with server-independent access control, relying only on an Apache .htaccess file, so on a web server that does not honor .htaccess such as nginx an unauthenticated visitor...

CVE-2026-16981

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not perform any authorization check no capability, nonce, login, or ownership check on one of its shipping-label download endpoints, so an unauthenticated attacker can enumerate sequential ids and download every stored...

CVE-2026-16993

The DHL Shipping Germany for WooCommerce WordPress plugin (versions before 4.0.1 ) contains a vulnerability where the shipping-label storage directory lacks server-independent access control. The plugin relies solely on an Apache .htaccess file for protection; consequently, on web servers that do...

CVE-2026-16981

The DHL Shipping Germany for WooCommerce WordPress plugin, in versions prior to 4.0.1 , is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The application fails to perform essential authorization checks—such as capability, nonce, login, or ownership verification—on a specific shipp...

CVE-2026-16981: Authorization Bypass Through User-Controlled Key

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not perform any authorization check no capability, nonce, login, or ownership check on one of its shipping-label download endpoints, so an unauthenticated attacker can enumerate sequential ids and download every stored...

CVE-2026-16993: Exposure of Sensitive Information to an Unauthorized Actor

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not protect its shipping-label storage directory with server-independent access control, relying only on an Apache .htaccess file, so on a web server that does not honor .htaccess such as nginx an unauthenticated visitor...

EUVD-2026-42565

The DHL eCommerce Benelux for WooCommerce plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check and missing nonce verification on the createlabel and deletelabel functions in versions up to, and including, 2.2.3. These functions are wir...

Threat Outbreak Alert RuleID32913: Email Messages Distributing Malicious Software on June 7, 2018

Medium Alert ID: 58067 First Published: 2018 June 7 20:49 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32913 may contain the following files: Name | Size...

Threat Outbreak Alert RuleID31428: Email Messages Distributing Malicious Software on November 24, 2017

Medium Alert ID: 56042 First Published: 2017 November 27 13:16 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31428 may contain the following files: Name |...

Threat Outbreak Alert RuleID17920: Email Messages Distributing Malicious Software on September 11, 2015

Medium Alert ID: 40957 First Published: 2015 September 11 15:22 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID17920 may contain the following files: Name ...

Threat Outbreak Alert RuleID13077: Email Messages Distributing Malicious Software on January 12, 2015

Medium Alert ID: 36982 First Published: 2015 January 13 17:32 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID13077 may contain the following files: Name |...

Threat Outbreak Alert: Fake Shipping Information Email Messages on August 29, 2013

Medium Alert ID: 30544 First Published: 2013 August 29 15:49 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a failed package delivery notification from DHL Global for the recipient. The text in the message body attempts...