EUVD-2026-53113
GHSA-xqqx-fcgc-wmxp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible endpoint with no authentication (PR:N, AV:N, AC:L); impact is confidentiality-only PII leakage with no integrity or availability consequence.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not perform any authorization check (no capability, nonce, login, or ownership check) on one of its shipping-label download endpoints, so an unauthenticated attacker can enumerate sequential ids and download every stored shipping label, each containing the customer's full name, complete postal address, and order reference.
AnalysisAI
Unauthenticated IDOR in the DHL Shipping Germany for WooCommerce WordPress plugin (versions before 4.0.1) exposes every generated shipping label to any internet visitor. The plugin's label-download endpoint performs no authorization check whatsoever - no capability check, nonce, login requirement, or order-ownership verification - and labels are indexed by predictable sequential IDs, enabling trivial full enumeration. A publicly available exploit exists; successful exploitation leaks customer full names, complete postal addresses, and order references at scale, carrying significant GDPR implications for any German e-commerce operator running the affected plugin.
Technical ContextAI
The affected software is a WooCommerce plugin (CPE: cpe:2.3:a:unknown:dhl_shipping_germany_for_woocommerce:*:*:*:*:*:*:*:*) that integrates DHL's shipping label generation into WordPress/WooCommerce stores targeting the German market. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), a classic IDOR pattern: the endpoint accepts a user-supplied numeric identifier to retrieve a stored label file, but never checks whether the requesting party is authenticated, is the owning customer, or holds any WordPress capability. Because WooCommerce order and label IDs are sequential integers, an attacker can trivially walk the full ID space without prior knowledge. The absence of a nonce also means there is no CSRF protection layer that could incidentally limit access.
RemediationAI
Upgrade to DHL Shipping Germany for WooCommerce version 4.0.1 or later immediately; this is the vendor-released patch per WPScan's advisory at https://wpscan.com/vulnerability/61b3228d-50a0-4928-977a-23448939dff9/. If an immediate upgrade is not possible, the most effective compensating control is to restrict access to the plugin's label-download endpoint at the web server or WAF layer - identify the specific endpoint URI from the plugin's source and return 403 for unauthenticated requests; note that this may break legitimate label re-download workflows for customers. Alternatively, temporarily disabling label download functionality via plugin settings (if available) eliminates the attack surface at the cost of customer self-service. Rate-limiting the endpoint by IP is insufficient given that sequential enumeration can be distributed across many IPs. There is no known workaround that preserves full functionality without patching.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today