CVE-2026-9235: DHL eCommerce (Benelux) for WooCommerce <= 2.2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shipping Label Creation and Deletion via dhlpwc_label_create and dhlpwc_label_delete AJAX Actions
The DHL eCommerce (Benelux) for WooCommerce plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check and missing nonce verification on the createlabel() and deletelabel() functions in versions up to, and including, 2.2.3. These functions are wired to the wpajaxdhlpwclabelcreate and wpajaxdhlpwclabeldelete hooks and act on an attacker-supplied postid (WooCommerce order ID). This makes it possible for authenticated attackers, with Subscriber-level access and above, to create or delete DHL shipping labels associated with any WooCommerce order on the site.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9235?
CVE-2026-9235 has a medium severity score of 4.3.
How do I fix CVE-2026-9235?
To fix CVE-2026-9235, update the DHL eCommerce (Benelux) for WooCommerce plugin to version 2.2.4 or later.
What types of actions are vulnerable in CVE-2026-9235?
CVE-2026-9235 allows authenticated users to create and delete shipping labels without proper authorization.
Who is affected by CVE-2026-9235?
Users of the DHL eCommerce (Benelux) for WooCommerce plugin for WordPress versions up to 2.2.3 are affected by CVE-2026-9235.
What are the consequences of exploiting CVE-2026-9235?
Exploiting CVE-2026-9235 can lead to unauthorized data modification and potential data loss.