WordPress Plugin Vulnerabilities

DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Download via IDOR

Description

The plugin does not perform any authorization check (no capability, nonce, login, or ownership check) on one of its shipping-label download endpoints, so an unauthenticated attacker can enumerate sequential ids and download every stored shipping label, each containing the customer's full name, complete postal address, and order reference.

Proof of Concept

Affects Plugins

Plugin icon
dhl-for-woocommerce
Fixed in 4.0.1

References

CVE
CVE-2026-16981

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Pedro Pinho, Artus KG
Submitter
Pedro Pinho
Verified
Yes
WPVDB ID
61b3228d-50a0-4928-977a-23448939dff9

Timeline

Publicly Published
2026-07-27 (about 9 days ago)
Added
2026-08-04 (about 18 hours ago)
Last Updated
2026-08-04 (about 18 hours ago)

Other

Published
Title
Published
2025-11-11
Title
Payment Plugins Braintree For WooCommerce < 3.2.79 - Missing Authorization to Payment Token Exposure and Transaction Fraud
Published
2025-05-01
Title
Homey - Booking and Rentals WordPress Theme < 2.4.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion
Published
2025-12-24
Title
Membership For WooCommerce < 3.0.4 - Unauthenticated Insecure Direct Object Reference
Published
2024-10-16
Title
WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin < 1.0.26 - Insecure Direct Object Reference to Unauthenticated Arbitrary User Password/Email Reset/Account Takeover
Published
2026-01-02
Title
Overton <= 1.3 - Authenticated (Subscriber+) Insecure Direct Object Reference