Unauthorized Access Vulnerability in DHL Shipping Plugin for WooCommerce
CVE-2026-16981
What is CVE-2026-16981?
The DHL Shipping Germany plugin for WooCommerce prior to version 4.0.1 has a significant vulnerability that allows attackers to exploit a lack of authorization checks on its shipping-label download endpoints. Without requiring any form of authentication or verification such as capability checks, nonces, or ownership confirmations, an unauthenticated attacker can sequentially enumerate IDs. This flaw enables them to download all stored shipping labels, which include sensitive information such as customers' full names, complete postal addresses, and order references. Website owners utilizing this plugin are advised to update to the latest version immediately to protect their customers' data.
Affected Version(s)
DHL Shipping Germany for WooCommerce 0 < 4.0.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.