CVE-2026-16981

Name of the Vulnerable Software and Affected Versions DHL Shipping Germany for WooCommerce WordPress plugin versions prior to 4.0.1

Description An issue exists where a shipping-label download endpoint does not perform authorization checks, such as capability, nonce, login, or ownership verification. This allows an unauthenticated attacker to use Insecure Direct Object Reference (IDOR)—a flaw where an application provides direct access to objects based on user-supplied input—to enumerate sequential ids and download stored shipping labels. These labels contain sensitive customer information, including full names, complete postal addresses, and order references.

Recommendations Update the plugin to version 4.0.1 or later.