What is the CVSS score of CVE-2026-9235?

CVE-2026-9235 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

DHL WooCommerce Plugin CVE-2026-9235

EUVD-2026-42565 MEDIUM

Missing Authorization (CWE-862)

2026-07-09 Wordfence

GHSA-x7cc-jgf9-8v48

WordPress Authentication Bypass Wordpress Plugin Dhl Ecommerce Benelux For Woocommerce

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.4 MEDIUM

PR:L confirmed by wp_ajax_ login requirement; A:L added over vendor score because label deletion directly disrupts order fulfillment availability.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 11:57 vuln.today

CVE Published

Jul 09, 2026 - 09:31 nvd

MEDIUM 4.3

DescriptionCVE.org

The DHL eCommerce (Benelux) for WooCommerce plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check and missing nonce verification on the create_label() and delete_label() functions in versions up to, and including, 2.2.3. These functions are wired to the wp_ajax_dhlpwc_label_create and wp_ajax_dhlpwc_label_delete hooks and act on an attacker-supplied post_id (WooCommerce order ID). This makes it possible for authenticated attackers, with Subscriber-level access and above, to create or delete DHL shipping labels associated with any WooCommerce order on the site.

AnalysisAI

Unauthorized shipping label manipulation in DHL eCommerce (Benelux) for WooCommerce versions up to 2.2.3 allows any authenticated WordPress user - down to Subscriber level - to create or delete DHL shipping labels for any WooCommerce order site-wide. The two vulnerable AJAX handlers lack both capability verification and nonce (CSRF token) checks, meaning the attacker-supplied order ID is acted upon without confirming the caller has order management rights. No public exploit is identified and this is not listed in CISA KEV, but the low authentication bar (any registered user) and operational impact on fulfillment make this a meaningful risk for Benelux e-commerce stores with open user registration.

Technical ContextAI

The plugin registers two WordPress AJAX actions - wp_ajax_dhlpwc_label_create and wp_ajax_dhlpwc_label_delete - handled by create_label() and delete_label() in includes/controller/admin/class-dhlpwc-controller-admin-order-metabox.php (lines 117, 164, and 25 per source references). WordPress AJAX hooks prefixed with wp_ajax_ require a logged-in session but impose no automatic role or capability enforcement. The plugin fails to invoke current_user_can() to verify the caller holds shop management rights (CWE-862: Missing Authorization), and also omits check_ajax_referer() nonce validation, removing the secondary CSRF protection layer. Callers supply an arbitrary post_id (WooCommerce order ID), which the functions act on without confirming ownership. The affected CPE is cpe:2.3:a:dhlparcel:dhl_ecommerce_(benelux)_for_woocommerce:*:*:*:*:*:*:*:* through version 2.2.3.

RemediationAI

Update the DHL eCommerce (Benelux) for WooCommerce plugin to the version incorporating changeset 3575375 from the WordPress plugin repository (https://plugins.trac.wordpress.org/changeset?reponame=&old=3575375%40dhlpwc&new=3575375%40dhlpwc); the exact released patched version number is not confirmed from available data and should be verified on the WordPress plugin page or the Wordfence advisory before deployment. As an interim compensating control, disable open user registration on the WordPress site (Settings > General > uncheck 'Anyone can register') to prevent attackers from obtaining Subscriber accounts - note this affects legitimate customer registration flows and may require an alternative onboarding path. A web application firewall rule blocking POST requests to /wp-admin/admin-ajax.php with action values of dhlpwc_label_create or dhlpwc_label_delete from non-administrative sessions provides an additional layer of defense. Role management plugins that strip wp_ajax hook access from Subscriber-level users can further reduce exposure until patching is complete.