Inadequate Access Control in DHL Shipping Plugin for WooCommerce
CVE-2026-16993
What is CVE-2026-16993?
The DHL Shipping for WooCommerce plugin prior to version 4.0.1 is susceptible to an access control vulnerability that allows unauthenticated users to access sensitive shipping labels. This flaw arises from inadequate protection of its shipping-label storage directory, depending solely on an Apache .htaccess file for security. As a result, on servers that do not support .htaccess, such as nginx, an attacker could easily retrieve stored shipping labels by guessing predictable filenames. Each label contains sensitive customer information, making this vulnerability particularly concerning for user privacy.
Affected Version(s)
DHL Shipping Germany for WooCommerce 0 < 4.0.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.