EUVD-2026-53114
GHSA-q7cc-q448-hh85
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
AC:H reflects the nginx-only precondition outside attacker control; C:L covers partial PII exposure; no integrity or availability impact applies.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not protect its shipping-label storage directory with server-independent access control, relying only on an Apache .htaccess file, so on a web server that does not honor .htaccess (such as nginx) an unauthenticated visitor can download stored shipping labels (each containing a customer's name and postal address) by requesting predictable filenames.
AnalysisAI
Unauthenticated information disclosure in DHL Shipping Germany for WooCommerce (versions before 4.0.1) exposes stored shipping labels - each containing customer name and postal address - to any visitor who can request predictable filenames from the label storage directory. The plugin relies exclusively on an Apache .htaccess file for directory access control, which nginx and other non-Apache web servers silently ignore, leaving the directory fully browsable over the network. A publicly available exploit exists (via WPScan), though EPSS of 0.14% at the 4th percentile indicates low observed exploitation activity, and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
The vulnerability is rooted in CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) caused by server-dependent access control. The plugin stores generated shipping label files in a web-accessible directory and places an Apache .htaccess directive to block direct HTTP access - a mechanism native to Apache httpd. However, nginx (a widely adopted alternative web server) does not parse or honor .htaccess files by default; without a separate nginx location block denying access, the directory is fully accessible. The CPE cpe:2.3:a:unknown:dhl_shipping_germany_for_woocommerce:*:*:*:*:*:*:*:* covers all versions through 4.0.0. The predictability of filenames further compounds the issue, as attackers do not require directory listing - only a guessable naming pattern - to retrieve labels.
RemediationAI
Update the DHL Shipping Germany for WooCommerce plugin to version 4.0.1 or later, which implements server-independent access control for the label storage directory. This is the definitive fix and should be applied immediately on all nginx-served WooCommerce deployments. As an interim workaround for nginx environments, add a server-side location block in the nginx configuration (e.g., 'location ~* /wp-content/uploads/dhl-labels/ { deny all; }') to block direct HTTP access to the label directory; note that this requires nginx reload and admin access to the server configuration. Alternatively, shipping label files can be relocated to a path outside the web root entirely, though this may require plugin reconfiguration. Apache-hosted deployments are protected by the existing .htaccess directive and face lower urgency, but patching is still recommended. See the WPScan advisory at https://wpscan.com/vulnerability/efcf57b5-f35e-4943-8a49-350aa8bf1b8a/ and NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-16993.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today