CVE-2026-16993: DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Disclosure via Unprotected Uploads Directory
The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not protect its shipping-label storage directory with server-independent access control, relying only on an Apache .htaccess file, so on a web server that does not honor .htaccess (such as nginx) an unauthenticated visitor can download stored shipping labels (each containing a customer's name and postal address) by requesting predictable filenames.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16993?
CVE-2026-16993 has a risk score of 54, indicating a moderate severity vulnerability.
What does CVE-2026-16993 affect?
CVE-2026-16993 affects the DHL Shipping Germany plugin for WooCommerce versions prior to 4.0.1.
How does CVE-2026-16993 impact users?
CVE-2026-16993 allows unauthenticated users to access shipping labels stored in an unprotected uploads directory.
How do I fix CVE-2026-16993?
You can fix CVE-2026-16993 by updating the DHL Shipping Germany for WooCommerce plugin to version 4.0.1 or later.
What is the exploit method for CVE-2026-16993?
CVE-2026-16993 is exploited through inadequate access control relying on an .htaccess file, which may be ignored by some web servers such as nginx.