Dhl Shipping Germany For Woocommerce
Monthly
Unauthenticated information disclosure in DHL Shipping Germany for WooCommerce (versions before 4.0.1) exposes stored shipping labels - each containing customer name and postal address - to any visitor who can request predictable filenames from the label storage directory. The plugin relies exclusively on an Apache .htaccess file for directory access control, which nginx and other non-Apache web servers silently ignore, leaving the directory fully browsable over the network. A publicly available exploit exists (via WPScan), though EPSS of 0.14% at the 4th percentile indicates low observed exploitation activity, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated IDOR in the DHL Shipping Germany for WooCommerce WordPress plugin (versions before 4.0.1) exposes every generated shipping label to any internet visitor. The plugin's label-download endpoint performs no authorization check whatsoever - no capability check, nonce, login requirement, or order-ownership verification - and labels are indexed by predictable sequential IDs, enabling trivial full enumeration. A publicly available exploit exists; successful exploitation leaks customer full names, complete postal addresses, and order references at scale, carrying significant GDPR implications for any German e-commerce operator running the affected plugin.
Unauthenticated information disclosure in DHL Shipping Germany for WooCommerce (versions before 4.0.1) exposes stored shipping labels - each containing customer name and postal address - to any visitor who can request predictable filenames from the label storage directory. The plugin relies exclusively on an Apache .htaccess file for directory access control, which nginx and other non-Apache web servers silently ignore, leaving the directory fully browsable over the network. A publicly available exploit exists (via WPScan), though EPSS of 0.14% at the 4th percentile indicates low observed exploitation activity, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated IDOR in the DHL Shipping Germany for WooCommerce WordPress plugin (versions before 4.0.1) exposes every generated shipping label to any internet visitor. The plugin's label-download endpoint performs no authorization check whatsoever - no capability check, nonce, login requirement, or order-ownership verification - and labels are indexed by predictable sequential IDs, enabling trivial full enumeration. A publicly available exploit exists; successful exploitation leaks customer full names, complete postal addresses, and order references at scale, carrying significant GDPR implications for any German e-commerce operator running the affected plugin.