CVE-2026-16993— DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Disclosure via Unprotected Uploads Directory
Possible ATT&CK Techniques 1AI
T1005 · Data from Local SystemAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | DHL Shipping Germany for WooCommerce | < 4.0.1 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-16993
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Disclosure via Unprotected Uploads Directory
Source: CVE Program / CVE List V5
Vulnerability Description
The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not protect its shipping-label storage directory with server-independent access control, relying only on an Apache .htaccess file, so on a web server that does not honor .htaccess (such as nginx) an unauthenticated visitor can download stored shipping labels (each containing a customer's name and postal address) by requesting predictable filenames.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress DHL Shipping Germany for WooCommerce 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress DHL Shipping Germany for WooCommerce是WordPress基金会的一款整合德国物流服务的电商插件。 WordPress DHL Shipping Germany for WooCommerce 4.0.1之前版本存在安全漏洞，该漏洞源于未对运输标签存储目录实施服务器无关的访问控制，仅依赖Apache .htaccess文件，在不受理.htaccess的Web服务器（如nginx）上，未经身份验证的访问者可通过请求可预测文件名下载存储的运输标签，导致客户
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | DHL Shipping Germany for WooCommerce | 0 ~ 4.0.1 | - |
II. Public POCs for CVE-2026-16993
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16993
请登录查看更多情报信息。
News Coverage for CVE-2026-16993 (1)
Same Patch Batch · Unknown · 2026-08-05 · 24 CVEs total
| CVE-2026-16981 | DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Download via IDOR | |
| CVE-2026-16573 | Bit Form < 3.2.0 - Unauthenticated Stored XSS via SVG Signature Upload | |
| CVE-2026-16602 | Content Protector (Passster) < 4.3.6 - Unauthenticated Non-Public Post Content Disclosure | |
| CVE-2026-16583 | Orbit Fox by ThemeIsle < 3.0.8 - Author+ Stored XSS via SVG Upload | |
| CVE-2026-16561 | Sunshine Photo Cart < 3.6.12 - Unauthenticated Private Gallery Comment Disclosure | |
| CVE-2026-16603 | Content Protector (Passster) < 4.3.6 - Unauthenticated Category-Locked Content Disclosure | |
| CVE-2026-16736 | User Registration & Membership < 5.2.6 - Unauthenticated Account Creation While Registrati | |
| CVE-2026-16613 | GDPR Cookie Compliance < 5.1.0 - Cookie Deletion and Forced Logout via CSRF | |
| CVE-2026-16604 | Content Protector (Passster) < 4.3.6 - Unauthenticated Protected Content Disclosure via Co | |
| CVE-2026-16746 | MultiVendorX < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commission | |
| CVE-2026-16605 | MultiVendorX < 5.0.11 - Store Owner+ Cross-Vendor Store Takeover and Deletion via Missing | |
| CVE-2026-16940 | Custom Fields for WooCommerce < 1.5.1 - Unauthenticated Arbitrary File Deletion via Path T | |
| CVE-2026-16055 | Contest Gallery < 30.0.7 - Unauthenticated Login-Protection and 2FA Bypass via post_cg_log | |
| CVE-2026-16968 | GeoDirectory < 2.8.168 - Contributor+ User Email Disclosure via geodir_json_search_users | |
| CVE-2026-16942 | WP Custom HTML Pages <= 0.6.2 - Author+ Stored XSS | |
| CVE-2025-15677 | GeoDirectory < 2.8.110 - Editor+ Stored XSS via Place Categories | |
| CVE-2026-14553 | Zportals < 6.3.4 - Subscriber+ Arbitrary File Upload | |
| CVE-2026-15210 | Login/Signup with Phone Number, OTP Verification < 1.8.71 - Unauthenticated Account Takeov | |
| CVE-2026-15230 | YayPricing < 3.5.7 - Subscriber+ Pricing Configuration Modification and Coupon Code Disclo | |
| CVE-2026-15372 | WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via Passkeys Provider |
Showing top 20 of 24 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: Unknown
- CVE-2026-15239
Simple CAPTCHA with Cloudflare Turnstile < 1.42.0 - Unauthen - CVE-2026-15211
Subscriptions for WooCommerce < 2.0.1 - Payment Bypass via A - CVE-2026-15148
WP Events Manager < 2.2.5 - Unauthenticated Payment Bypass a - CVE-2026-16258
Ajax Search Lite < 4.14.5 - Unauthenticated PHP Object Injec - CVE-2026-16265
WP Maps < 4.9.7 - Subscriber+ Denial of Service
V. Comments for CVE-2026-16993
No comments yet