CVE-2026-16993

3.7 LOW

Published 2026-08-05 · Updated 2026-08-05

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not protect its shipping-label storage directory with server-independent access control, relying only on an Apache .htaccess file, so on a web server that does not honor .htaccess (such as nginx) an unauthenticated visitor can download stored shipping labels (each containing a customer's name and postal address) by requesting predictable filenames.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CWE-200

All references

https://wpscan.com/vulnerability/efcf57b5-f35e-4943-8a49-350aa8bf1b8a/

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.