https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-01T20:36:04.516854+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-16981 CVE-2026-16981 — DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Download via IDOR 2026-10-01T20:36:04.548994+00:00

Affected: Unknown DHL Shipping Germany for WooCommerce

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not perform any authorization check (no capability, nonce, login, or ownership check) on one of its shipping-label download endpoints, so an unauthenticated attacker can enumerate sequential ids and download every stored shipping label, each containing the customer's full name, complete postal address, and order reference.